CoreDNS versions prior to 1.14.7 improperly accepted DNS UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC transports, allowing unauthenticated clients to send DNS UPDATE requests through the proxy/forward plugin to upstream DNS servers. This bypassed the opcode rejection enforced on UDP and TCP transports, potentially enabling unauthorized DNS record modifications if the upstream trusts CoreDNS's source or connection without end-to-end TSIG authentication. A fix is available that enforces the correct request policy on all affected transports before dispatch.
CoreDNS versions prior to 1.14.7 contain a vulnerability in their custom transport implementations for DNS-over-HTTPS (DoH/DoH3), DNS-over-QUIC (DoQ), and DNS-over-gRPC. An unauthenticated attacker can craft DNS requests with maliciously large section counts using DNS name compression, causing excessive memory allocation during request unpacking. This can lead to memory exhaustion and termination of the CoreDNS process. The issue arises because CoreDNS bypasses early validation of DNS section counts that is present in the underlying miekg/dns UDP and TCP server implementations. A patch is available that applies proper validation before unpacking requests to prevent this memory exhaustion.
A vulnerability in CoreDNS's `k8s_external` headless AXFR functionality can cause the `transfer` plugin to panic when it emits an empty transfer batch. This issue affects certain versions of CoreDNS and has been fixed in version 1.14.5.
CoreDNS versions prior to 1.14.3 have a vulnerability in TSIG authentication handling on gRPC, QUIC, DoH, and DoH3 transports. The gRPC and QUIC transports verify only the TSIG key name but do not validate the HMAC, allowing requests with forged MACs to bypass authentication if the key name matches. The DoH and DoH3 transports do not verify TSIG at all, accepting any TSIG record regardless of key name or MAC validity. This flaw enables attackers to bypass TSIG authentication and access TSIG-protected operations such as zone transfers and dynamic updates.
CoreDNS versions prior to 1.14.3 have a vulnerability in the tsig plugin where TSIG authentication can be bypassed on encrypted transports such as DoT, DoH, DoH3, DoQ, and gRPC. This occurs because these transports do not properly verify TSIG signatures and instead trust the transport writer's TsigStatus(), which always returns nil, allowing unauthenticated clients to bypass TSIG-based access controls.
CoreDNS versions prior to 1.14.3 contain a vulnerability in the transfer plugin where the selection of ACL stanzas for zone transfers uses lexicographic comparison instead of longest zone match. This flaw allows a permissive parent zone transfer rule to override a more restrictive subzone rule, enabling unauthorized clients to perform zone transfers (AXFR/IXFR) on subzones that should be restricted. The issue is fixed in version 1.14.3.
CoreDNS DNS-over-QUIC (DoQ) server has a vulnerability where a remote unauthenticated attacker can cause excessive goroutine and memory growth by opening many QUIC streams and stalling after sending only 1 byte. This leads to unbounded goroutine backlog and blocked workers due to missing per-stream read deadlines, resulting in a denial-of-service (DoS) condition via memory exhaustion and potential crash.
CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://` block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies.