CVE-2022-2837 coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints
Attackers can redirect external TLD traffic to malicious pods by creating matching namespaces, potentially intercepting data or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-2837?
CVE-2022-2837 is a medium-severity vulnerability in coreDNS, published on 3 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.
Which versions are affected by CVE-2022-2837?
2 open source packages ship an affected version, including github.com/coredns/coredns. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coredns/coredns Go | All versions to 1.9.3 | None |
github.com/coredns/coredns Go | All versions to 1.9.3 | None |
Products include Coredns.io Coredns.
How do I fix CVE-2022-2837?
No fix has been published for CVE-2022-2837 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2837 being exploited?
There is no known exploitation of CVE-2022-2837 in the wild and no public exploit code.
Other vulnerabilities in coreDNS
- CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
- CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification
- CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports
- CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
- CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
Sources
Also known as GHSA-h828-v5pv-33qx.