VulnSocial

CVE-2026-62309General(coredns.io / coredns)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch coredns.io coredns systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.

coredns.io CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-476

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • coredns

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-18); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
coredns.io
Products
coredns

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-18: 2Mentions · 2026-07-19: 1Patch / Workaround · 2026-07-18: 1Technical Details · 2026-07-18: 107-1807-19
Signal classification2 categories
General
266.7%
Patch
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-182
General1Patch1
2026-07-191
General1
Full discourse3 posts
  • connect24h@connect24h
    Patch

    正直、28バイトでDNSが沈むのは勘弁してほしい。なんでこの３連休中なの。狙ってるの？ Kubernetes上の事実上の標準であるCoreDNS 1.14.4未満でproxyproto pluginが有効だと、認証不要の単一PPv2 UDP datagramでprocessをpanicさせられる。CVE-2026-62309、CVSS 7.5。non-UDP transportを示すheaderからnil pointer dereferenceに至る。 CSIRT初動は、CoreDNS version、Corefileのproxyproto、UDP/53の到達元、Pod restart countとproxyproto.go:83のstack traceを棚卸し。現場で怖いのは、DNS障害がcluster全体のapplication障害に見えることだ。proxyproto不要なら外し、必要ならLBのCIDRだけに絞り、現行1.14.6へ更新してほしい。該当環境は変更計画へ即時載せる案件だ。 #セキュリティ

    Post summary

    The post details CVE‑2026‑62309 affecting CoreDNS 1.14.4 and older, noting a denial‑of‑service via a crafted PPv2 UDP datagram, and recommends disabling proxyproto or upgrading to 1.14.6 to mitigate the issue.

    1492925110.0K
    6.8K followersView on X
  • connect24h@connect24h
    General

    ソース: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62309

    Post summary

    The text merely gives a reference link to Microsoft’s advisory for CVE‑2026‑62309 without providing additional details on exploitation or mitigation.

    02010834
    4.5K followersView on X
  • eno@eno1693812
    General

    memo https://nvd.nist.gov/vuln/detail/CVE-2026-62309

    Post summary

    The message simply references the CVE via an NVD link without providing additional context or details.

    0000037
    19 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcoredns.iocoredns---

Explore more

Back to dashboardcoredns.io CVEscoredns vulnerabilities