CVE-2026-62299

MediumCVSS 5.3/10Last modified Jul 22, 2026

Description

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
coredns	coredns	< 1.14.5

References

https://github.com/coredns/coredns/commit/fc447d0658b093edc8cd29a6b171216a44a644c2Patch
https://github.com/coredns/coredns/pull/8190Issue Tracking, Patch
https://github.com/coredns/coredns/releases/tag/v1.14.5Release Notes
https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7Exploit, Third Party Advisory
https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7Exploit, Third Party Advisory

Timeline

Published: Jul 16, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-62307.5The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and inc CVE-2026-623006.5Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments up to and including ve CVE-2026-623017.1MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the CVE-2026-623028.7MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` CVE-2026-623035.9Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/CVE-2026-623089.1Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user CVE-2026-623097.5CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plug CVE-2026-62317.5The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping valida CVE-2026-623128.89Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on CVE-2026-623134.3Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of `restricted.containers.privile CVE-2026-623145.8Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 CVE-2026-623157.1Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dicti