Memory Exhaustion Vulnerability in CoreDNS DNS-over-QUIC Server by CoreDNS
CVE-2026-32934

8.7HIGH

Key Information:

Vendor

Coredns

Status
Coredns
Vendor
CVE Published:
5 May 2026

What is CVE-2026-32934?

CoreDNS, a DNS server utilizing a plugin architecture, has a vulnerability in its DNS-over-QUIC server present in versions before 1.14.3. This flaw allows a remote attacker to open multiple QUIC streams and send minimal data, leading to unbounded growth of goroutines and memory usage. In scenarios where the worker pool is at capacity, new goroutines continue to spawn for each accepted stream, creating a backlog. Active worker processes can hang indefinitely due to a lack of read deadlines, leading to a potential denial of service. This allows an attacker to exhaust memory resources systematically, resulting in potential out-of-memory (OOM) conditions. The vulnerability has been addressed in version 1.14.3, and no workarounds are available.

Affected Version(s)

coredns < 1.14.3

References

https://github.com/coredns/coredns/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/coredns/coredns/releases/tag/v1.14.3
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.