CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification
Remote attackers can cause denial of service in CoreDNS by sending oversized DNS-over-HTTPS GET requests that trigger excessive CPU and memory usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32936?
CVE-2026-32936 is a high-severity denial of service vulnerability in coredns, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.
Weakness: CWE-400
Which versions are affected by CVE-2026-32936?
3 open source packages ship an affected version, including github.com/coredns/coredns. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coredns/coredns Go | All versions | 1.14.3 |
github.com/coredns/coredns Go | All versions | 1.14.3 |
github.com/coredns/coredns Go | All versions | 1.14.3 |
Products include Coredns.io Coredns.
How do I fix CVE-2026-32936?
Upgrade github.com/coredns/coredns to 1.14.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32936 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32936 exists.
Other vulnerabilities in coredns
- CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
- CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports
- CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
- CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
- CVE-2026-26017 CoreDNS ACL Bypass
Sources
Also known as AZL-85724, CLEANSTART-2026-BP22631, CLEANSTART-2026-SO59114, ECHO-3575-11f2-ad06, GHSA-63cw-r7xf-jmwr, GO-2026-5164 and 20 more.