PT-2026-23722 · Coredns · Coredns

Younevsky · Published 2026-03-06 · Updated 2026-05-09 · CVE-2026-26018

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.2

Description CoreDNS is a DNS server that utilizes chained plugins. A denial of service condition exists in the loop detection plugin due to a predictable pseudo-random number generator (PRNG) used for generating a secret query name. This, combined with a fatal error handler, can cause the DNS server to crash when receiving specially crafted DNS queries.

Recommendations Update to version 1.14.2 or later.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

CWE-337

Related Identifiers

AZL-79500

AZL-79529

CVE-2026-26018

GHSA-H75P-J8XM-M278

GO-2026-4635

OPENSUSE-SU-2026:10297-1

OPENSUSE-SU-2026:20619-1

SUSE-SU-2026:1042-1

Affected Products

Coredns

References · 150

• 🔥 https://github.com/coredns/coredns/security/advisories/GHSA-h75p-j8xm-m278 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26018.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26018 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20619-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h75p-j8xm-m278 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10297-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26018 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4635 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79500 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79529 · Vendor Advisory
• https://github.com/coredns/coredns · Note
• https://github.com/coredns/coredns/releases/tag/v1.14.2 · Note
• https://suse.com/security/cve/CVE-2026-25921 · Note
• https://suse.com/security/cve/CVE-2026-32246 · Note