CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
Remote attackers can cause memory exhaustion and service outage in CoreDNS by exploiting unbounded goroutine growth in the DNS-over-QUIC server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32934?
CVE-2026-32934 is a high-severity denial of service vulnerability in coredns, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.
Weakness: CWE-770
Which versions are affected by CVE-2026-32934?
3 open source packages ship an affected version, including github.com/coredns/coredns. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coredns/coredns Go | All versions | 1.14.3 |
github.com/coredns/coredns Go | All versions | 1.14.3 |
github.com/coredns/coredns Go | All versions | 1.14.3 |
Products include Coredns.io Coredns.
How do I fix CVE-2026-32934?
Upgrade github.com/coredns/coredns to 1.14.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32934 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32934 exists.
Other vulnerabilities in coredns
- CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification
- CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports
- CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
- CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
- CVE-2026-26017 CoreDNS ACL Bypass
Sources
Also known as AZL-85728, CLEANSTART-2026-JU13039, CLEANSTART-2026-UC10506, ECHO-41d8-a79c-3211, GHSA-2wpx-qpw2-g5h5, GO-2026-4969 and 20 more.