DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-82399: CVE-2026-82399: Resource Exhaustion Denial of Service in CoreDNS Custom Transports

#security #cve #cybersecurity

CVE-2026-82399: Resource Exhaustion Denial of Service in CoreDNS Custom Transports

Vulnerability ID: CVE-2026-82399
CVSS Score: 7.5
Published: 2026-09-17

CVE-2026-82399 is a resource management vulnerability in CoreDNS affecting custom DNS transport pathways. Prior to version 1.14.7, transports including DNS-over-HTTPS (DoH), DNS-over-QUIC (DoQ), and DNS-over-gRPC executed the resource-intensive unpack method of the underlying Go DNS library on raw, untrusted incoming payloads before validating the fixed 12-byte DNS header. An unauthenticated remote attacker can exploit this behavior by using nested DNS name compression pointers to trigger substantial heap allocations, leading to memory exhaustion and server termination.

TL;DR

CoreDNS custom transports (DoH, DoQ, gRPC) processed raw payloads without validating the DNS header, enabling unauthenticated remote attackers to trigger out-of-memory crashes via nested DNS name compression pointers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed
  • Vulnerability Type: Denial of Service (DoS)

Affected Systems

  • CoreDNS deployments using custom transports (DoH, DoQ, gRPC)
  • coredns: >= v1.10.1, < v1.14.7 (Fixed in: v1.14.7)

Code Analysis

Commit: 530b0a5

Unpack request safely by validating header before full parsing

Exploit Details

Mitigation Strategies

  • Upgrade CoreDNS to 1.14.7 or higher
  • Configure WAF filtering on DoH endpoints to drop requests with high QDCOUNT
  • Disable unused custom transports (DoH, DoQ, gRPC) in the Corefile

Remediation Steps:

  1. Verify the running CoreDNS version in production using 'coredns -version'.
  2. Update container image references in Kubernetes manifests to point to coredns/coredns:1.14.7.
  3. Apply the updated deployment configuration using kubectl or gitops pipelines.
  4. Establish monitoring rules on Go heap usage metrics to identify abnormal allocation spikes.

References

Read the full report for CVE-2026-82399 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)