Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-05 | 2 | Disclosure1General1 |
| 2026-05-06 | 1 | Disclosure1 |
CVE-2026-32934 Unbounded Goroutine and Memory Growth in CoreDNS Versions Prior to 1.14.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32934
Post summary
This post announces CVE‑2026‑32934, detailing an unbounded goroutine and memory growth issue in CoreDNS versions before 1.14.3, without providing PoC, exploit, or patch information.
🚨*CVE* CVE-2026-32934 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a… https://www.cve.org/CVERecord?id=CVE-2026-32934 ----- Traducción: CVE-2026-32934 Cor… http://infoflow.cloud`
Post summary
The post discloses a new CoreDNS vulnerability (CVE-2026-32934) where versions prior to 1.14.3 can suffer from unbounded goroutine and memory growth via DNS-over-QUIC, with no active exploitation, patch, or PoC details provided.
CVE-2026-32934 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a… https://www.cve.org/CVERecord?id=CVE-2026-32934
Post summary
The note highlights a resource exhaustion flaw in CoreDNS’s DNS‑over‑QUIC implementation (unbounded goroutine and memory growth) for versions before 1.14.3, but it provides no PoC, exploit, patch, or active exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | coredns.io | coredns | - | - | - |