The flaw in CoreDNS’s DNS‑over‑HTTPS GET path allows any remote unauthenticated client to submit oversized dns= query parameters that are parsed, base64 decoded, and unpacked before the request is rejected. Because the GET path lacks a size limit, these operations consume excessive CPU cycles, allocate large amounts of memory, and trigger frequent garbage collection, which can exhaust server resources. The consequence is a denial‑of‑service for all users of the affected CoreDNS instance. The weakness is a classic unbounded resource consumption problem, classified as CWE‑400.

CoreDNS, the open‑source DNS server used in many Kubernetes and other cloud deployments, is affected by this vulnerability in any version prior to 1.14.3. The vulnerability was fixed in release 1.14.3, which can be obtained from the CoreDNS GitHub releases page. Systems running earlier releases are at risk unless mitigated.

The CVSS score of 8.7 indicates a high severity for Denial of Service. The EPSS score is not available, but the lack of a known exploit in the CISA KEV catalog does not reduce the risk of passive denial‑of‑service attacks. The vulnerability is exploitable over the public internet from any host without authentication, making it attractive for attackers seeking to disrupt infrastructure. Because the attack only requires sending oversized GET requests, it can be automated and amplified if coordinated across multiple machines.