CoreDNS up to 1.12.1 allocation of resources

Summaryinfo

A vulnerability classified as critical has been found in CoreDNS up to 1.12.1. Impacted is an unknown function. This manipulation causes allocation of resources. The identification of this vulnerability is CVE-2025-47950. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in CoreDNS up to 1.12.1. It has been declared as critical. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

CoreDNS is a DNS server that chains plugins. In versions prior to 1.21.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments. The patch in version 1.21.2 introduces two key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://` block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-47950 since 05/14/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 241912 (Azure Linux 3.0 Security Update: coredns (CVE-2025-47950)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.12.2 eliminates this vulnerability. Applying the patch efaed02c6a480ec147b1f799aab7cf815b17dfe1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (241912) and EUVD (EUVD-2025-17359). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• CoreDNS

Version

• 1.12.0
• 1.12.1

License

• open-source

Website

• Product: https://github.com/coredns/coredns/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion