CoreDNS up to 1.14.2 DNS Message resource consumption

Summaryinfo

A vulnerability classified as problematic was found in CoreDNS up to 1.14.2. Affected is an unknown function of the component DNS Message Handler. Executing a manipulation can lead to resource consumption. This vulnerability appears as CVE-2026-32936. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in CoreDNS up to 1.14.2 and classified as problematic. This vulnerability affects an unknown function of the component DNS Message Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-32936 since 03/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 313705 (openSUSE 16 Security Update : coredns (openSUSE-SU-2026:20703-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.14.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (313705) and EUVD (EUVD-2026-27442). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• CoreDNS

Version

• 1.14.0
• 1.14.1
• 1.14.2

Website

• Product: https://github.com/coredns/coredns/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion