Description
CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.
Published: 2026-07-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CoreDNS’s rewrite plugin contains a null pointer dereference (CWE-476) when a downstream plugin returns a response without an OPT record. An unauthenticated client can issue a single ordinary DNS query that matches a rewrite edns0 revert rule, causing the plugin to crash or return SERVFAIL, thereby degrading availability. The vulnerability is a remote denial of service with a CVSS score of 5.3 and does not provide code execution or other direct attack vectors.

Affected Systems

The vulnerability affects CoreDNS versions earlier than 1.14.5, specifically the rewrite plugin that handles edns0 rewrite rules with a revert flag.

Risk and Exploitability

The vulnerability has an EPSS score of less than 1%, indicating a low probability of exploitation in the wild, and it is not listed in CISA’s KEV catalog. An attacker can remotely and unauthenticated fabricate a DNS query that matches a revert rule; the plugin will panic, returning SERVFAIL or crashing the CoreDNS process if debugging is disabled. The impact is limited to availability of the DNS service for the affected server, with no compromise of data integrity or confidentiality.

Generated by OpenCVE AI on July 31, 2026 at 01:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CoreDNS to 1.14.5 or later.
  • If an upgrade cannot be performed immediately, remove or disable rewrite edns0 revert rules that can trigger the bug.
  • Monitor DNS service logs for unexpected SERVFAIL replies or process crashes and apply network-level limits against anomalous query patterns.

Generated by OpenCVE AI on July 31, 2026 at 01:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Coredns.io
Coredns.io coredns
Vendors & Products Coredns.io
Coredns.io coredns

Fri, 17 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Description CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.
Title CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Coredns.io Coredns
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-17T18:06:37.349Z

Reserved: 2026-07-13T18:37:08.489Z

Link: CVE-2026-62299

cve-icon Vulnrichment

Updated: 2026-07-17T17:11:28.459Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T01:30:05Z

Weaknesses