CVE-2026-62994 CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
A remote attacker can crash CoreDNS by requesting AXFR for a specific headless service configuration, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62994?
CVE-2026-62994 is a low-severity denial of service vulnerability in coredns, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
Which versions are affected by CVE-2026-62994?
3 open source packages ship an affected version, including github.com/coredns/coredns. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coredns/coredns Go | From 1.9.4 | 1.14.5 |
github.com/coredns/coredns Go | From 1.9.4 | 1.14.5 |
github.com/coredns/coredns Go | From 1.9.4 | 1.14.5 |
Products include Coredns.io Coredns.
How do I fix CVE-2026-62994?
Upgrade github.com/coredns/coredns to 1.14.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-62994 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62994 exists.
Other vulnerabilities in coredns
- CVE-2026-32934 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service
- CVE-2026-32936 CoreDNS DoH GET path missing size validation causes CPU and memory amplification
- CVE-2026-33190 CoreDNS TSIG authentication bypass on encrypted DNS transports
- CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
- CVE-2026-35579 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
Sources
Also known as AZL-92895, ECHO-0581-5ceb-411c, GHSA-74w3-63xv-x9mv, GO-2026-6805, MINI-4mc2-x74h-q8hr, MINI-7299-hjwp-xc7r and 17 more.