CoreDNS parses attacker-controlled DNS section counts before validating them on DoH, DoH3, DoQ, and DNS-over-gRPC listeners. An unauthenticated client can exploit DNS name compression to send a single 65,533-byte request that allocates over 10 MiB of memory during unpacking. Concurrent requests can exhaust server memory and cause CoreDNS to terminate. Unlike the miekg/dns UDP/TCP server, CoreDNS's custom transports do not apply early validation of DNS section counts before unpacking, allowing this memory exhaustion attack. The fix involves applying the default message acceptance function to the DNS header before unpacking requests in these custom transports. This vulnerability is tracked as CVE-2026-82399 and affects CoreDNS versions before 1.14.7.

An unauthenticated attacker can cause a denial of service by exhausting the memory of a CoreDNS server through specially crafted DNS requests over DoH, DoH3, DoQ, or DNS-over-gRPC transports. This results in termination of the CoreDNS process, disrupting DNS resolution services. There is no confidentiality or integrity impact reported. The attack requires no authentication and can be triggered remotely.

A patch is available for CoreDNS that fixes this issue by applying proper validation of DNS section counts before unpacking requests in the affected custom transports. Users should upgrade to CoreDNS version 1.14.7 or later. Until patched, mitigating controls at the network level (such as rate limiting or filtering malformed DNS-over-HTTPS/QUIC/gRPC requests) may help reduce exposure, but the root cause is fixed only by applying the official update.