VulnSocial

CVE-2026-82399Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header. An unauthenticated client can use DNS name compression and excessive section counts to amplify allocation before the plugin chain, so plugin-level rate limiting cannot prevent concurrent requests from exhausting memory and terminating CoreDNS. The ordinary UDP and TCP listeners are not affected because they validate the header first. This issue is fixed in version 1.14.7.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-18); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-18: 1Mentions · 2026-09-20: 1Patch / Workaround · 2026-09-20: 1Technical Details · 2026-09-18: 1Technical Details · 2026-09-20: 109-1809-20
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-181
Disclosure1
2026-09-201
Patch1
Full discourse2 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - CoreDNS DoH/DoQ/DoG Memory Exhaustion DoS (CVE-2026-82399) CoreDNS custom transports for DNS-over-HTTPS/HTTP3, DNS-over-QUIC, and DNS-over-gRPC unpack attacker-controlled DNS section counts before validating the fixed header; crafted requests abusing DNS name compression + excessive section counts trigger amplified allocations and OOM, crashing CoreDNS. UDP/TCP listeners are not affected. 👉Affected: http://github.com/coredns/coredns < 1.14.7 | Upgrade to 1.14.7

    Post summary

    Announces a memory‑exhaustion DoS (CVE‑2026‑82399) in CoreDNS custom transports for DNS‑over‑HTTPS/QUIC/gRPC that can crash services via crafted DNS requests abusing name compression, and advises upgrading to version 1.14.7.

    00010122
    307 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 CoreDNS, Allocation of Resources Without Limits or Throttling, #CVE-2026-82399 (High) -DC-Sep2026-2454 https://dailycve.com/coredns-allocation-of-resources-without-limits-or-throttling-cve-2026-82399-high-dc-sep2026-2454/

    Post summary

    The text announces CVE-2026-82399 and characterizes it as a CoreDNS resource-allocation flaw. It provides no evidence of exploitation, PoC code, or remediation.

    0000038
    237 followersView on X

Explore more

Back to dashboard