CoreDNS DNS-over-QUIC (DoQ) server has a vulnerability where a remote unauthenticated attacker can cause excessive goroutine and memory growth by opening many QUIC streams and stalling after sending only 1 byte. This leads to unbounded goroutine backlog and blocked workers due to missing per-stream read deadlines, resulting in a denial-of-service (DoS) condition via memory exhaustion and potential crash.