CVE-2026-32934

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/coredns/coredns/releases/tag/v1.14.3	Release Notes
https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5	Exploit Vendor Advisory
https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-05 20:16

Updated : 2026-07-25 11:10

NVD link : CVE-2026-32934

Mitre link : CVE-2026-32934

CVE.ORG link : CVE-2026-32934

JSON object : View

Products Affected

coredns.io

coredns

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-32934", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32934", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-06T15:14:18.362180Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coredns", "product": "coredns", "versions": [{"status": "affected", "version": "< 1.14.3"}]}]}], "published": "2026-05-05T20:16:35.853", "references": [{"url": "https://github.com/coredns/coredns/releases/tag/v1.14.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist."}, {"lang": "es", "value": "CoreDNS es un servidor DNS que encadena plugins. En versiones anteriores a la 1.14.3, el servidor DNS-over-QUIC (DoQ) puede ser llevado a un crecimiento ilimitado de goroutines y memoria por un cliente remoto que abre muchas transmisiones QUIC y env\u00eda solo 1 byte por transmisi\u00f3n. Cuando el pool de trabajadores est\u00e1 lleno, CoreDNS a\u00fan genera una goroutine por transmisi\u00f3n aceptada para esperar un token de trabajador. Adem\u00e1s, los trabajadores activos se bloquean indefinidamente en io.ReadFull() sin un plazo de lectura por transmisi\u00f3n, lo que permite a un atacante inmovilizar a todos los trabajadores enviando un solo byte para que la lectura se bloquee esperando el segundo byte del prefijo de longitud DoQ. Esto permite a un atacante remoto no autenticado causar agotamiento de memoria y OOM-kill. Este problema ha sido solucionado en la versi\u00f3n 1.14.3. No existen soluciones alternativas conocidas."}], "lastModified": "2026-07-25T11:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B1F8FE2-314C-4C38-9F18-099ACCFF0AAD", "versionEndExcluding": "1.14.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}