CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
CVE-2026-62994 is a vulnerability in CoreDNS version 3.0 where the `k8s_external` headless AXFR can emit an empty transfer batch that causes the `transfer` plugin to panic. This issue is related to improper handling of empty transfer batches in the DNS transfer process.
AI Analysis
Technical Summary
This vulnerability involves CoreDNS's `k8s_external` headless AXFR functionality emitting an empty transfer batch, which triggers a panic in the `transfer` plugin. The root cause aligns with CWE-248 (Uncaught Exception), indicating that the software does not properly handle an unexpected empty batch during DNS zone transfers. The affected version explicitly identified is CoreDNS 3.0.
Potential Impact
The vulnerability causes the `transfer` plugin in CoreDNS to panic, which likely results in a denial of service condition for DNS services relying on this plugin. There is no information about exploitation in the wild or further impact such as privilege escalation or data leakage.
Mitigation Recommendations
No patch or remediation information is currently available. Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. Until a fix is released, users should monitor official vendor communications for updates.
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
Description
CVE-2026-62994 is a vulnerability in CoreDNS version 3.0 where the `k8s_external` headless AXFR can emit an empty transfer batch that causes the `transfer` plugin to panic. This issue is related to improper handling of empty transfer batches in the DNS transfer process.
Affected software
pkg:golang/github.com/coredns/corednsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves CoreDNS's `k8s_external` headless AXFR functionality emitting an empty transfer batch, which triggers a panic in the `transfer` plugin. The root cause aligns with CWE-248 (Uncaught Exception), indicating that the software does not properly handle an unexpected empty batch during DNS zone transfers. The affected version explicitly identified is CoreDNS 3.0.
Potential Impact
The vulnerability causes the `transfer` plugin in CoreDNS to panic, which likely results in a denial of service condition for DNS services relying on this plugin. There is no information about exploitation in the wild or further impact such as privilege escalation or data leakage.
Mitigation Recommendations
No patch or remediation information is currently available. Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. Until a fix is released, users should monitor official vendor communications for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_vex
- Csaf Version
- 2.0
- Publisher
- Microsoft Security Response Center
- Advisory Id
- msrc_CVE-2026-62994
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a7891d2bf8831d539c8693e
Added to database: 08/09/2026, 14:42:26 UTC
Last enriched: 08/09/2026, 14:48:29 UTC
Last updated: 08/10/2026, 00:41:18 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.