Coredns-Plugins: Cluster-Dns Falls Ohne Auth-Schutz

Two fresh CoreDNS vulnerabilities affect the cluster DNS: rewrite with EDNS0-revert and proxyproto under PROXY v2. An unauthenticated client can bring down availability – in one case a 28-byte UDP datagram suffices. Fixed in 1.14.5 or 1.14.4.

Related: Prioritize 622 CVEs: Patch Panic Instead  ·  CI/CD published the AsyncAPI botnet loader  ·  Mini Shai-Hulud: npm worm devours the supply chain

What the two vulnerabilities technically trigger

CoreDNS is the DNS layer for services and pods in many Kubernetes and cloud‑native stacks. The vulnerabilities reside in two specific plugins and affect response and packet processing.

CVE-2026-62299 affects the rewrite plugin before version 1.14.5. EDNS0 rules that include an optional revert call res.IsEdns0() and dereference the result without a nil check when a downstream plugin returns a response without an OPT record. A remote, unauthenticated client can trigger a panic in the ResponseReverter with a crafted DNS query. Consequence: SERVFAIL and loss of availability. With recovery disabled via the debug directive, the process can be hard terminated. Source: NVD and GitHub Advisory GHSA-9pmm-cxww-rrr7, CNA-CVSS 5.3 (Availability Low).

CVE-2026-62309 affects proxyproto before version 1.14.4. A single 28-byte UDP datagram containing a PROXY‑v2 header and non‑UDP transport (e.g., Family byte 0x11) leads to a nil pointer in PacketConn.ReadFrom when logging addr.String() before ServeDNS recovery kicks in. CNA-CVSS 7.5 (Availability High). Source: NVD and GHSA-9rvv-m5g5-wc8r.

Why This Hits the Control Plane

DNS outages in the cluster act like a silent multiplier: Service discovery stalls, sidecars and ingress lose targets, health checks tip over. A DoS on CoreDNS blocks the operability of workloads above.

Both issues are CWE-476 (NULL Pointer Dereference). It’s about availability. Confidentiality and integrity of data remain untouched according to CNA vectors. The priority stays high if CoreDNS is the sole resolver layer in the cluster and scales without a pod disruption budget.

CISA-SSVC marks CVE-2026-62299 with automatable=yes and exploitation=poc. CVE-2026-62309 with automatable=yes and exploitation=none (status of advisory enrichment). For operators, the reachable attack surface matters: rewrite rules with EDNS0-revert and exposed proxyproto before the patch.

What Teams Should Check Now

First, inventory: Which CoreDNS version is running in the clusters? Which plugins are present in the Corefile? proxyproto is relatively new and often only meaningful behind load balancers. rewrite with EDNS0-revert is more specific – that’s where 62299 sits.

Anyone using managed Kubernetes should review the control plane change log of the provider. Self‑hosted and on‑prem distributions remain under your own patch responsibility. Stage clusters with the same Corefile plugins first, then production with a controlled rollout.

Assessment Without Panic Patching

Two plugin vulnerabilities on a single day trigger batch alarms. The reliable approach remains: clarify attack surface and fix window, then prioritize. Clusters with a public DNS path and active proxyprotocol stand apart from clusters with internal rewrite without EDNS0 revert. The fixes are published – 1.14.4 for proxyprotocol, 1.14.5 for rewrite. Those who update anyway can take the newer line.

Primary sources for further reading: NVD entries CVE-2026-62299 and CVE-2026-62309, the GitHub Security Advisories and the CoreDNS release tags v1.14.4 and v1.14.5.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

Which CoreDNS versions are affected?

CVE-2026-62299: rewrite before 1.14.5. CVE-2026-62309: proxyproto before 1.14.4. Both fixes are included in the mentioned releases.

Must every Kubernetes cluster be patched immediately?

As soon as the affected plugins are active and reachable, prioritize them. Without proxyproto and without EDNS0-revert in the rewrite, the practical exposure – version maintenance remains mandatory.

Is this a data leak or RCE?

After CNA assessment, both CVEs target Availability (DoS/Panic). Confidentiality and integrity are unaffected in the vectors.

Is 1.14.4 sufficient as the target version?

1.14.4 drops support for proxyproto. For rewrite (62299), 1.14.5 is the cited fix version. Anyone looking to address both issues should plan on using 1.14.5 or newer.

Where are the official advisories?

GitHub Security Advisories GHSA-9pmm-cxww-rrr7 and GHSA-9rvv-m5g5-wc8r, plus NVD and CoreDNS release notes for v1.14.4/v1.14.5.

Editor’s Picks

Editor’s Pick622 CVEs: Prioritize Over Panic PatchingEditor’s PickTwo Joomla Upload Vulnerabilities Added to CISA KEVEditor’s PickCI/CD Published AsyncAPI Botnet Loader

More from the MBF Media Network

cloudmagazinCloudFront 5xx: What VPC Origins Teams Need to CheckDigital ChiefsHow to Stifle Open Source Without Banning It