CVE-2026-62299 Null dereference in coredns
Remote attackers can crash CoreDNS or cause service degradation by triggering a nil-pointer panic in the rewrite plugin when specific EDNS0 revert rules are configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62299?
CVE-2026-62299 is a medium-severity vulnerability in coredns, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.
Weakness: CWE-476
Which versions are affected by CVE-2026-62299?
It affects 1 product.
Products include Coredns.io Coredns.
How do I fix CVE-2026-62299?
Upgrade to a fixed version.
Is CVE-2026-62299 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62299 exists.
Other vulnerabilities in coredns
- CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
- CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification
- CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports
- CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
- CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
Sources
Also known as AZL-92441, GHSA-9pmm-cxww-rrr7.