DNS Server Vulnerability in CoreDNS Prior to Version 1.14.4
CVE-2026-62309

7.5HIGH

Key Information:

Vendor: Coredns
Status: Coredns
Vendor: CVE Published:; 16 July 2026

What is CVE-2026-62309?

CoreDNS, a widely used DNS server written in Go, has a vulnerability that allows a single crafted 28-byte UDP datagram to crash the server when the proxyproto plugin is enabled. Specifically, the issue lies in how the PacketConn.ReadFrom method processes PROXY v2 headers when they employ non-UDP transport types, potentially leading to improper address handling and subsequent server failure. This vulnerability has been addressed in CoreDNS version 1.14.4, making it critical for users to upgrade to this version to ensure resilience against such attacks.