Bug 2501510 (CVE-2026-62994) - CVE-2026-62994 coredns: CoreDNS: Denial of Service via crafted AXFR request with k8s_external headless-service
Summary: CVE-2026-62994 coredns: CoreDNS: Denial of Service via crafted AXFR request w...
Keywords:
Status: NEW
Alias: CVE-2026-62994
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-16 20:01 UTC by OSIDB Bzimport
Modified: 2026-09-01 00:49 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-16 20:01:50 UTC 
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
Note You need to log in before you can comment on or make changes to this bug.