Key Takeaways<\/p>\n
- \n
- CVE-2026-62299 (rewrite):<\/strong> EDNS0-Revert without Nil-Check. Ordinary Query can trigger Panic\/SERVFAIL. Fix: CoreDNS 1.14.5. CVSS 5.3 (CNA).<\/li>\n
- CVE-2026-62309 (proxyproto):<\/strong> PROXY-v2-Header with non-UDP transport. A 28-byte UDP packet can terminate the process. Fix: 1.14.4. CVSS 7.5 (CNA).<\/li>\n
- Prerequisite:<\/strong> Affected installations have the respective plugins active and reachable. Many Kubernetes clusters use CoreDNS by default.<\/li>\n
- Immediate:<\/strong> Check version and Corefile, upgrade to 1.14.5 (covers both fixes), and keep ProxyProto only behind trusted load balancers.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/strong> Prioritize 622 CVEs: Patch Panic Instead<\/a> \u00b7 CI\/CD published the AsyncAPI botnet loader<\/a> \u00b7 Mini Shai-Hulud: npm worm devours the supply chain<\/a><\/p>\n
\nWhat is the CoreDNS incident?<\/strong> Two nil pointers in the plugins rewrite (EDNS0-revert, CVE-2026-62299, Fix 1.14.5) and proxyproto (PROXY v2, CVE-2026-62309, Fix 1.14.4) allow remote DoS against reachable CoreDNS instances. Operators check Corefile, version and attack surface, then roll to 1.14.5 or newer.<\/p>\n<\/div>\n
What the two vulnerabilities technically trigger<\/h2>\n
CoreDNS is the DNS layer for services and pods in many Kubernetes and cloud\u2011native stacks. The vulnerabilities reside in two specific plugins and affect response and packet processing.<\/p>\n
CVE-2026-62299<\/strong> affects the rewrite plugin before version 1.14.5. EDNS0 rules that include an optional revert call res.IsEdns0() and dereference the result without a nil check when a downstream plugin returns a response without an OPT record. A remote, unauthenticated client can trigger a panic in the ResponseReverter with a crafted DNS query. Consequence: SERVFAIL and loss of availability. With recovery disabled via the debug directive, the process can be hard terminated. Source: NVD and GitHub Advisory GHSA-9pmm-cxww-rrr7, CNA-CVSS 5.3 (Availability Low).<\/p>\n
CVE-2026-62309<\/strong> affects proxyproto before version 1.14.4. A single 28-byte UDP datagram containing a PROXY\u2011v2 header and non\u2011UDP transport (e.g., Family byte 0x11) leads to a nil pointer in PacketConn.ReadFrom when logging addr.String() before ServeDNS recovery kicks in. CNA-CVSS 7.5 (Availability High). Source: NVD and GHSA-9rvv-m5g5-wc8r.<\/p>\n
\n28<\/div>\nBytes needed for the proxyproto crash (CVE-2026-62309)<\/p>\n
Source: NVD \/ GitHub Security Advisory<\/p>\n<\/div>\n
Why This Hits the Control Plane<\/h2>\n
DNS outages in the cluster act like a silent multiplier: Service discovery stalls, sidecars and ingress lose targets, health checks tip over. A DoS on CoreDNS blocks the operability of workloads above.<\/p>\n
Both issues are CWE-476 (NULL Pointer Dereference). It’s about availability. Confidentiality and integrity of data remain untouched according to CNA vectors. The priority stays high if CoreDNS is the sole resolver layer in the cluster and scales without a pod disruption budget.<\/p>\n
CISA-SSVC marks CVE-2026-62299 with automatable=yes and exploitation=poc. CVE-2026-62309 with automatable=yes and exploitation=none (status of advisory enrichment). For operators, the reachable attack surface matters: rewrite rules with EDNS0-revert and exposed proxyproto before the patch.<\/p>\n
What Teams Should Check Now<\/h2>\n
First, inventory: Which CoreDNS version is running in the clusters? Which plugins are present in the Corefile? proxyproto is relatively new and often only meaningful behind load balancers. rewrite with EDNS0-revert is more specific \u2013 that\u2019s where 62299 sits.<\/p>\n
\nOPERATOR CHECKLIST<\/p>\n
- \n
- ✓<\/span>Capture CoreDNS image tag and Chart\/Operator version across all clusters<\/li>\n
- ✓<\/span>Scan Corefile for rewrite (EDNS0 + revert) and proxyproto<\/li>\n
- ✓<\/span>Roll out to 1.14.5 (or distro backport with both fixes)<\/li>\n
- ✓<\/span>Keep proxyproto reachable only from trusted LB networks<\/li>\n
- ✓<\/span>Monitor crashloop\/panic logs and DNS latency after rollout<\/li>\n<\/ul>\n<\/div>\n
Anyone using managed Kubernetes should review the control plane change log of the provider. Self\u2011hosted and on\u2011prem distributions remain under your own patch responsibility. Stage clusters with the same Corefile plugins first, then production with a controlled rollout.<\/p>\n
Assessment Without Panic Patching<\/h2>\n
Two plugin vulnerabilities on a single day trigger batch alarms. The reliable approach remains: clarify attack surface and fix window, then prioritize. Clusters with a public DNS path and active proxyprotocol stand apart from clusters with internal rewrite without EDNS0 revert. The fixes are published – 1.14.4 for proxyprotocol, 1.14.5 for rewrite. Those who update anyway can take the newer line.<\/p>\n
Primary sources for further reading: NVD entries CVE-2026-62299 and CVE-2026-62309, the GitHub Security Advisories and the CoreDNS release tags v1.14.4 and v1.14.5.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nWhich CoreDNS versions are affected?<\/strong><\/summary>\n
CVE-2026-62299: rewrite before 1.14.5. CVE-2026-62309: proxyproto before 1.14.4. Both fixes are included in the mentioned releases.<\/p>\n<\/details>\n
\nMust every Kubernetes cluster be patched immediately?<\/strong><\/summary>\n
As soon as the affected plugins are active and reachable, prioritize them. Without proxyproto and without EDNS0-revert in the rewrite, the practical exposure – version maintenance remains mandatory.<\/p>\n<\/details>\n
\nIs this a data leak or RCE?<\/strong><\/summary>\n
After CNA assessment, both CVEs target Availability (DoS\/Panic). Confidentiality and integrity are unaffected in the vectors.<\/p>\n<\/details>\n
\nIs 1.14.4 sufficient as the target version?<\/strong><\/summary>\n
1.14.4 drops support for proxyproto. For rewrite (62299), 1.14.5 is the cited fix version. Anyone looking to address both issues should plan on using 1.14.5 or newer.<\/p>\n<\/details>\n
\nWhere are the official advisories?<\/strong><\/summary>\n
GitHub Security Advisories GHSA-9pmm-cxww-rrr7 and GHSA-9rvv-m5g5-wc8r, plus NVD and CoreDNS release notes for v1.14.4\/v1.14.5.<\/p>\n<\/details>\n
<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/cover-hero-15-250x143.jpg\")
<\/span>Editor’s Pick<\/span>622 CVEs: Prioritize Over Panic Patching<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/joomla-icagenda-balbooa-kev-upload-rce-cover-hero-250x141.jpg\")
<\/span>Editor’s Pick<\/span>Two Joomla Upload Vulnerabilities Added to CISA KEV<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/cover-hero-12-250x143.jpg\")
<\/span>Editor’s Pick<\/span>CI\/CD Published AsyncAPI Botnet Loader<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-cloudfront-5xx-was-vpc-origins-teams-pru-67055442.jpg\")
<\/span>cloudmagazin<\/span>CloudFront 5xx: What VPC Origins Teams Need to Check<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-dean-ball-open-weight-macht-fud-dach-25610384-250x143.jpg\")
<\/span>Digital Chiefs<\/span>How to Stifle Open Source Without Banning It<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Coredns: rewrite-EDNS0 and proxyproto allow remote-DoS. Fixes in 1.14.5 and 1.14.4 – what cluster-teams check.","protected":false},"author":10,"featured_media":22385,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"coredns plugins","_yoast_wpseo_title":"Coredns-Plugins: Cluster-Dns Falls Ohne Auth-Schutz","_yoast_wpseo_metadesc":"Coredns rewrite and proxyproto: two DoS vulnerabilities (CVE-2026-62299 and CVE-2026-62309). Fixes 1.14.5\/1.14.4 plus operator-checklist.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[255],"tags":[],"class_list":["post-22516","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-praxis-umsetzung-en"],"evm_reading_time_minutes":5,"wpml_language":"en","wpml_translation_of":22384,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22516"}],"version-history":[{"count":1,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22516\/revisions"}],"predecessor-version":[{"id":22543,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22516\/revisions\/22543"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/22385"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} - ✓<\/span>Scan Corefile for rewrite (EDNS0 + revert) and proxyproto<\/li>\n
- CVE-2026-62309 (proxyproto):<\/strong> PROXY-v2-Header with non-UDP transport. A 28-byte UDP packet can terminate the process. Fix: 1.14.4. CVSS 7.5 (CNA).<\/li>\n