Denial of Service Vulnerability in CoreDNS by Cloudflare
CVE-2026-32936

8.7HIGH

Key Information:

Vendor

Coredns

Status
Coredns
Vendor
CVE Published:
5 May 2026

What is CVE-2026-32936?

A vulnerability in CoreDNS, the DNS server developed by Cloudflare, allows a remote, unauthenticated attacker to send oversized DNS-over-HTTPS (DoH) GET requests. In versions prior to 1.14.3, these requests are subject to expensive processing due to a lack of proper size validation, which can lead to high CPU usage, significant memory allocation, and increased garbage-collection pressure. This lack of restriction makes the server susceptible to denial of service (DoS) attacks. The issue has been addressed in version 1.14.3, where proper bounds checking has been implemented for the GET path.

Affected Version(s)

coredns < 1.14.3

References

https://github.com/coredns/coredns/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/coredns/coredns/releases/tag/v1.14.3
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.