Bug 2522862

Summary: coredns__release-4.16: quic-go v0.42.0: remote panic via post-handshake undecryptable packets (GO-2025-4017 / CVE-2025-29785)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agarcial, akhatavk, aoconnor, aos-team-art-private, asdas, asegurap, dpaolell, gparvin, jbalunas, jburrell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhaigner, security-response-team, sghai, sidsharm, suppawar, tsze, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 19:13:41 UTC 
## golang.org/x/net v0.17.0 — HTTP/2 CONTINUATION-flood DoS (CVE-2023-45288) reachable via DoH listener

**CWEs:** CWE-1333, CWE-400
**CVSS:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
**Component:** openshift-4.16-payload/coredns__release-4.16

### Description
The module pins golang.org/x/net at v0.17.0, which is vulnerable to CVE-2023-45288 (GO-2024-2687): an attacker can send an unbounded stream of HTTP/2 CONTINUATION frames forcing the server to decode HPACK headers indefinitely, exhausting CPU. CoreDNS's DoH server (ServerHTTPS) constructs an http.Server with NextProtos h2 enabled, so any cluster that enables the https:// transport block in the Corefile exposes this code path on the pod network. Fixed in golang.org/x/net v0.23.0.

### Affected Locations
- `:`
- `:`

### Evidence
**go.mod:120**
```go
golang.org/x/net v0.17.0 // indirect
```

**core/dnsserver/server_https.go:62-82 — h2 explicitly negotiated**
```go
if tlsConfig != nil {
    tlsConfig.NextProtos = []string{"h2", "http/1.1"}
}

srv := &http.Server{
    ReadTimeout:  s.readTimeout,
    WriteTimeout: s.writeTimeout,
    IdleTimeout:  s.idleTimeout,
    ErrorLog:     stdlog.New(&loggerAdapter{}, "", 0),
}
```

### Attack Pattern
Pod-network or external client with reach to the DoH port → unauthenticated CPU-exhaustion DoS of the cluster DNS pod.

---
*Source: Ex-Wing security assessment, finding FIND-001*