CoreDNS, a DNS server written in Go, contains a bug that causes the transfer plugin to panic when an AXFR (zone transfer) request is processed for a zone configured with the k8s_external headless-service plugin. The crash occurs only if the Kubernetes headless service has an endpoint with no declared ports, leading the plugin to create a port value of –1, skip the service, and send an empty list of records. When transfer.go then indexes the first element of that empty list, a panic is triggered, bringing down the CoreDNS process and denying DNS resolution to clients. This results in a denial of service for applications that depend on the affected DNS server.

Vendor CoreDNS, product CoreDNS, versions 1.9.4 through 1.14.5 inclusive. All releases prior to 1.14.5 contain the vulnerable code path; the issue is fixed in CoreDNS 1.14.5 and later.

The CVSS base score of 3.7 indicates low overall severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. CoreDNS is not listed in the CISA KEV catalog. The vulnerability can be triggered by an attacker who is able to send a DNS AXFR query to the CoreDNS server; based on the description, it is inferred that no local or authenticated privilege is required. While the crash only affects the DNS server process, it causes a service outage that could impact workload availability in a Kubernetes cluster.