coredns vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 202613

Newest CVEs

• CVE-2026-86003

  CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

  coredns · coredns

  High7.5
• CVE-2026-82399

  CoreDNS: Unauthenticated memory exhaustion in custom transports

  coredns · coredns

  High7.5
• CVE-2026-62299

  CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record

  coredns · coredns

  Medium5.3
• CVE-2026-62309

  CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS

  coredns · coredns

  High7.5
• CVE-2026-62994

  CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

  coredns · coredns

  Low3.7
• CVE-2026-35579

  CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports

  coredns · coredns

  High8.2
• CVE-2026-33489

  CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

  coredns · coredns

  High8.2
• CVE-2026-32936

  CoreDNS DoH GET path missing size validation causes CPU and memory amplification

  coredns · coredns

  High8.7
• CVE-2026-32934

  CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service

  coredns · coredns

  High8.7
• CVE-2026-33190

  CoreDNS TSIG authentication bypass on encrypted DNS transports

  coredns · coredns

  High8.7