CVE-2025-58063 CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion
Attackers can cause DNS resolution denial of service by exploiting etcd lease ID confusion to pin DNS cache entries with excessive TTLs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58063?
CVE-2025-58063 is a high-severity denial of service vulnerability in coredns, published on 9 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.
Weakness: CWE-681
Which versions are affected by CVE-2025-58063?
3 open source packages ship an affected version, including github.com/coredns/coredns.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coredns/coredns Go | From 1.2.0 | 1.12.4 |
github.com/coredns/coredns Go | From 1.2.0 | 1.12.4 |
github.com/coredns/coredns Go | From 1.2.0 | 1.12.4 |
Linux distribution packages (1)
coredns openSUSE:Tumbleweed | All versions | 1.12.4-2.1 |
How do I fix CVE-2025-58063?
Upgrade github.com/coredns/coredns to 1.12.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-58063 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58063 exists.
Sources
Also known as AZL-67097, AZL-67101, CLEANSTART-2026-PA51754, ECHO-e94f-2815-5e57, GHSA-93mf-426m-g6x9, GO-2025-3942 and 8 more.