https://vulnerability.circl.lu/sightings/feed 2026-09-20T13:26:19.234332+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/bf13ece3-fbb0-4882-8ca8-9644333fde2d/export 2026-09-20T13:26:19.257564+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bf13ece3-fbb0-4882-8ca8-9644333fde2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82399", "type": "seen", "source": "https://gist.github.com/alon710/b4f0369e3101a49089dd01d5083aac3c", "content": "# CVE-2026-82399: CVE-2026-82399: Resource Exhaustion Denial of Service in CoreDNS Custom Transports\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-82399\n\n## Summary\nCVE-2026-82399 is a resource management vulnerability in CoreDNS affecting custom DNS transport pathways. Prior to version 1.14.7, transports including DNS-over-HTTPS (DoH), DNS-over-QUIC (DoQ), and DNS-over-gRPC executed the resource-intensive unpack method of the underlying Go DNS library on raw, untrusted incoming payloads before validating the fixed 12-byte DNS header. An unauthenticated remote attacker can exploit this behavior by using nested DNS name compression pointers to trigger substantial heap allocations, leading to memory exhaustion and server termination.\n\n## TL;DR\nCoreDNS custom transports (DoH, DoQ, gRPC) processed raw payloads without validating the DNS header, enabling unauthenticated remote attackers to trigger out-of-memory crashes via nested DNS name compression pointers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Vulnerability Type**: Denial of Service (DoS)\n\n## Affected Systems\n\n- CoreDNS deployments using custom transports (DoH, DoQ, gRPC)\n- **coredns**: >= v1.10.1, < v1.14.7 (Fixed in: `v1.14.7`)\n\n## Mitigation\n\n- Upgrade CoreDNS to 1.14.7 or higher\n- Configure WAF filtering on DoH endpoints to drop requests with high QDCOUNT\n- Disable unused custom transports (DoH, DoQ, gRPC) in the Corefile\n\n**Remediation Steps:**\n1. Verify the running CoreDNS version in production using 'coredns -version'.\n2. Update container image references in Kubernetes manifests to point to coredns/coredns:1.14.7.\n3. Apply the updated deployment configuration using kubectl or gitops pipelines.\n4. Establish monitoring rules on Go heap usage metrics to identify abnormal allocation spikes.\n\n## References\n\n- [GitHub Security Advisory GHSA-mrg3-qvqr-jw29](https://github.com/coredns/coredns/security/advisories/GHSA-mrg3-qvqr-jw29)\n- [NVD CVE-2026-82399 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-82399)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-82399) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T09:31:38.760284Z"} 2026-09-18T09:31:38.760284+00:00 https://vulnerability.circl.lu/sighting/453bdcfb-6ad3-45ed-9023-df20e52918e0/export 2026-09-20T13:26:19.260226+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "453bdcfb-6ad3-45ed-9023-df20e52918e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82399", "type": "published-proof-of-concept", "source": "https://github.com/coredns/coredns/security/advisories/GHSA-mrg3-qvqr-jw29", "content": "", "creation_timestamp": "2026-09-17T22:35:17.218460Z"} 2026-09-17T22:35:17.218460+00:00