PT-2026-1913 · Coredns+1 · Coredns+1

Published 2026-01-08 · Updated 2026-05-21 · CVE-2025-68151

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.0

Description CoreDNS is a DNS server that utilizes plugins. Several CoreDNS server implementations, including gRPC, HTTPS, and HTTP/3, do not have sufficient resource limits. An unauthenticated remote attacker can deplete memory and disrupt or crash the server by establishing numerous concurrent connections, streams, or sending excessively large request bodies. This issue shares similarities with CVE-2025-47950 but impacts additional server types that do not enforce limits on connections, streams, or message sizes.

Recommendations Update to version 1.14.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

AZL-73850

AZL-74025

BDU:2026-03630

CLEANSTART-2026-VJ54611

CVE-2025-68151

GHSA-527X-5WRF-22M2

GO-2026-4289

SUSE-SU-2026:0142-1

Affected Products

Coredns

Red Os

References · 113

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68151.json · Exploit
• https://github.com/coredns/coredns/pull/7490 · Patch
• https://github.com/coredns/coredns/commit/0d8cbb1a6bcb6bc9c1a489865278b8725fa20812 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-13281 · Security Note
• https://osv.dev/vulnerability/GO-2026-4289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5187 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-VJ54611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32934 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26017 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58063 · Security Note
• https://osv.dev/vulnerability/AZL-73850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33811 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32936 · Security Note