The vulnerability arises when CoreDNS’s DNS-over-QUIC service opens an unbounded number of goroutines and drains memory by accepting many QUIC streams carrying minimal data. An unauthenticated remote client can trigger this behavior, causing the server to spawn a goroutine per stream even when its worker pool is exhausted and to block workers on a read that never completes. The result is memory exhaustion that can lead to an out‑of‑memory kill, denying service to legitimate clients. The weakness is a classic resource exhaustion flaw, classified as CWE‑770.

CoreDNS versions prior to 1.14.3 are affected. Any deployment of the CoreDNS server that enables DNS‑over‑QUIC and runs a version earlier than 1.14.3 is vulnerable.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the DoQ interface is accessible over the public network, an attacker can exploit the flaw from any remote host. No authentication or special privileges are required, so the risk to availability is significant.