CVE-2025-58063

CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf
https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9
https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9

Configurations

No configuration.

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) CoreDNS es un servidor DNS que encadena plugins. A partir de la versión 1.2.0 y anterior a la versión 1.12.4, el plugin etcd de CoreDNS contiene una vulnerabilidad de confusión de TTL donde los IDs de arrendamiento se utilizan incorrectamente como valores TTL, lo que permite ataques de fijación de caché DNS. Esto crea efectivamente una condición de DoS para la resolución DNS de los servicios afectados. La función 'TTL()' en 'plugin/etcd/etcd.go' convierte incorrectamente los IDs de arrendamiento de etcd (enteros de 64 bits) a uint32 y los utiliza como valores TTL. Los IDs de arrendamiento grandes se convierten en TTLs muy grandes cuando se convierten a uint32. Esto permite ataques de fijación de caché. La versión 1.12.4 contiene una solución para el problema.

Information

Published : 2025-09-09 20:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-58063

Mitre link : CVE-2025-58063

CVE.ORG link : CVE-2025-58063

JSON object : View

Products Affected

No product.

CWE

CWE-681

Incorrect Conversion between Numeric Types

{"id": "CVE-2025-58063", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58063", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T14:26:10.971285Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coredns", "product": "coredns", "versions": [{"status": "affected", "version": ">= 1.2.0, < 1.12.4"}]}]}], "published": "2025-09-09T20:15:48.057", "references": [{"url": "https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf", "source": "security-advisories@github.com"}, {"url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9", "source": "security-advisories@github.com"}, {"url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-681"}]}], "descriptions": [{"lang": "en", "value": "CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue."}, {"lang": "es", "value": "CoreDNS es un servidor DNS que encadena plugins. A partir de la versi\u00f3n 1.2.0 y anterior a la versi\u00f3n 1.12.4, el plugin etcd de CoreDNS contiene una vulnerabilidad de confusi\u00f3n de TTL donde los IDs de arrendamiento se utilizan incorrectamente como valores TTL, lo que permite ataques de fijaci\u00f3n de cach\u00e9 DNS. Esto crea efectivamente una condici\u00f3n de DoS para la resoluci\u00f3n DNS de los servicios afectados. La funci\u00f3n 'TTL()' en 'plugin/etcd/etcd.go' convierte incorrectamente los IDs de arrendamiento de etcd (enteros de 64 bits) a uint32 y los utiliza como valores TTL. Los IDs de arrendamiento grandes se convierten en TTLs muy grandes cuando se convierten a uint32. Esto permite ataques de fijaci\u00f3n de cach\u00e9. La versi\u00f3n 1.12.4 contiene una soluci\u00f3n para el problema."}], "lastModified": "2026-10-19T17:10:00.173", "sourceIdentifier": "security-advisories@github.com"}