Denial of Service Vulnerability in CoreDNS by a Leading DNS Solution Provider

CVE-2025-68151

What is CVE-2025-68151?

CoreDNS, a DNS server featuring plugin chaining, is susceptible to a denial of service vulnerability found in multiple server implementations such as gRPC, HTTPS, and HTTP/3, prior to version 1.14.0. This vulnerability allows an unauthenticated remote attacker to exploit the absence of resource-limiting controls, leading to memory exhaustion and potential server crashes. Attackers can leverage this flaw by establishing numerous concurrent connections, sending oversized request bodies, or streaming excessive data. The issue is reminiscent of similar vulnerabilities, but it affects additional server types lacking enforced limits. A patch has been introduced in version 1.14.0 to mitigate this risk.

References