CoreDNS Loop Detection Denial of Service Vulnerability (coredns coredns)
En bref
- Source
- NVD
- EPSS
- EPSS 1.16 % · centile 67 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Modified
Rechercher sur…
Description
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.
Faiblesses (CWE)
- CWE-337 — Predictable Seed in Pseudo-Random Number Generator (PRNG)
- CWE-770 — Allocation de ressources sans limite ni régulation
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
- CWE-1241 — Use of Predictable Algorithm in Random Number Generator
Références
- https://github.com/coredns/coredns/security/advisories/GHSA-h75p-j8xm-m278
- https://github.com/coredns/coredns/releases/tag/v1.14.2
- https://access.redhat.com/security/cve/CVE-2026-26018
- https://bugzilla.redhat.com/show_bug.cgi?id=2445242
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26018.json
- https://access.redhat.com/errata/RHSA-2026:36873
- https://access.redhat.com/errata/RHSA-2026:25127
- https://access.redhat.com/errata/RHSA-2026:8151
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat-SADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Avis
- GHSA-h75p-j8xm-m278 — CoreDNS Loop Detection Denial of Service Vulnerability
- GO-2026-4635 — CoreDNS Loop Detection Denial of Service Vulnerability in github.com/coredns/coredns
Références européennes
- ENISA EUVD · EUVD-2026-10043
- GCVE · GCVE-0-2026-26018
Avis du CERT-FR
- CERTFR-2026-AVI-0299 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*< 1.14.2
Produits affectés
| Produit | Versions |
|---|---|
| coredns · coredns | affected < 1.14.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |