PT-2026-37095 · Coredns · Coredns

Thesmartshadow · Published 2026-04-28 · Updated 2026-05-06 · CVE-2026-32936

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.3

Description CoreDNS is a DNS server that chains plugins. A denial-of-service issue exists in the DNS-over-HTTPS (DoH) GET path because it lacks early size validation for requests. A remote, unauthenticated attacker can send oversized requests to the '/dns-query' endpoint using the dns query parameter. The server performs expensive operations—including URL query parsing, base64 decoding via the base64ToMsg() function, and DNS message unpacking—before rejecting the request with a 400 Bad Request error.

This process forces high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, which can lead to degraded throughput and responsiveness or a complete denial of service, particularly on memory-constrained deployments.

Recommendations Update to version 1.14.3. As a temporary workaround, restrict access to the '/dns-query' endpoint or implement a web application firewall (WAF) to limit the size of GET request targets and the dns parameter.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-32936

GHSA-63CW-R7XF-JMWR

Affected Products

Coredns

References · 8

• 🔥 https://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32936 · Security Note
• https://osv.dev/vulnerability/GHSA-63cw-r7xf-jmwr · Vendor Advisory
• https://github.com/coredns/coredns/releases/tag/v1.14.3 · Note
• https://github.com/coredns/coredns · Note
• https://twitter.com/infoflowcloud/status/2051760538753863964 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051823556057571547 · Twitter Post
• https://twitter.com/CVEnew/status/2051758519565648182 · Twitter Post