Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-05 | 2 | Disclosure1General1 |
| 2026-05-06 | 1 | General1 |
CVE-2026-32936 Denial of Service via Oversized DNS-over-HTTPS GET Requests in CoreDNS https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32936
Post summary
The snippet reports a new DoS vulnerability in CoreDNS triggered by oversized DNS-over-HTTPS GET requests, but offers no PoC, exploit code, patch, or active exploitation details.
🚨*CVE* CVE-2026-32936 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs… https://www.cve.org/CVERecord?id=CVE-2026-32936 ----- Traducción: CVE-2026-32936 Cor… http://infoflow.cloud`
Post summary
The text points to CVE‑2026‑32936, noting an oversized DNS query parameter vulnerability in CoreDNS’s DoH GET path, but it provides no PoC, exploit, or patch information.
CVE-2026-32936 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs… https://www.cve.org/CVERecord?id=CVE-2026-32936
Post summary
CoreDNS before version 1.14.3 allows DoH GET requests with oversized dns parameters, potentially exposing a security weakness; no exploit, patch, or active exploitation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | coredns.io | coredns | - | - | - |