CoreDNS, a DNS server written in Go, has a vulnerability in the proxyproto plugin that can cause the process to panic and crash when it receives a single 28‑byte UDP datagram containing a PROXY v2 header with a non‑UDP transport type. The flaw occurs because the plugin attempts to use a nil address after a parsing error, leading to a dereference of a null pointer as described by CWE-476. An attacker can trigger the crash remotely with one well‑crafted packet, resulting in denial of service for the DNS service.

The affected product is CoreDNS from the coredns:coredns vendor. Versions prior to v1.14.4 are vulnerable; the issue was fixed in release v1.14.4. Any deployment running CoreDNS before this version with the proxyproto plugin enabled is at risk.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is listed as not in the CISA KEV catalog. An attacker needs only the ability to send a single malicious UDP packet to a CoreDNS instance with the proxyproto plugin enabled, making the attack feasible from a remote network but with a limited likelihood of discovery due to the low EPSS.