CVE-2025-68151

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints. Version 1.14.0 contains a patch.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Jan 8, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-681524.9Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through spCVE-2025-681536.5Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through spCVE-2025-681548.1systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformaCVE-2025-681557.5@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoiCVE-2025-681567.5Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flatCVE-2025-681573.7Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUCVE-2025-681588.8Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-tokenCVE-2025-68163.3A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /CVE-2025-681604.7Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes caCVE-2025-681614.8The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificatCVE-2025-681622.7In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configurationCVE-2025-681634.8In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page