CVE-2026-62309 Details
Description
CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.
A denial-of-service vulnerability has been identified in CoreDNS versions prior to 1.14.4, specifically within the proxyproto plugin. When this plugin is enabled, the CoreDNS process can be crashed by a single 28-byte UDP datagram containing a malformed PROXY v2 header. The issue arises because the 'PacketConn.ReadFrom' function improperly handles non-UDP transport headers, leading to a nil pointer dereference. This vulnerability allows for a remote, unauthenticated attack that can disrupt the DNS service by crashing the CoreDNS process.
Users can update to CoreDNS version 1.14.5, where this vulnerability has been patched. Instructions for downloading this version are available on the CoreDNS GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coredns/coredns/commit/60a439dd4febfcd78e3779e952fe3fbf3c16bb1f | [email protected] | Patch |
| https://github.com/coredns/coredns/pull/8154 | [email protected] | Issue TrackingPatch |
| https://github.com/coredns/coredns/releases/tag/v1.14.4 | [email protected] | Release Notes |
| https://github.com/coredns/coredns/security/advisories/GHSA-9rvv-m5g5-wc8r | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coredns.io coredns | < 1.14.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |