Remote Code Execution Vulnerability in CoreDNS by the CoreDNS Team
CVE-2026-62299

5.3MEDIUM

Key Information:

Vendor

Coredns

Status
Coredns
Vendor
CVE Published:
16 July 2026

What is CVE-2026-62299?

CoreDNS is an open-source DNS server implemented in Go. Versions prior to 1.14.5 include a vulnerability in the rewrite plugin's handling of edns0 rewrite rules. Specifically, when a response from a downstream plugin contains no OPT record, the logic fails to check for a nil response before dereferencing it. This oversight allows a remote, unauthenticated client to craft specific ordinary DNS queries that trigger a panic in the ResponseReverter component. Such an event can lead to a SERVFAIL response, causing degraded service availability or potentially crashing the CoreDNS process if recovery mechanisms are disabled. This vulnerability has been addressed in CoreDNS version 1.14.5.

Affected Version(s)

coredns < 1.14.5

References

https://github.com/coredns/coredns/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/coredns/coredns/pull/8190
x_refsource_MISC
https://github.com/coredns/coredns/commit/fc447d0658b093e...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.