CVE-2026-62994 Details
Description
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
A vulnerability in CoreDNS versions 1.9.4 prior to 1.14.5 allows a network DNS client to trigger a panic during AXFR zone transfers. This issue arises when CoreDNS is configured to use 'k8s_external' headless-service zone transfers, and Kubernetes has a headless service endpoint without declared ports. The 'k8s_external' transferer can then send an empty batch of DNS records, which the 'transfer' plugin attempts to process, leading to a panic. In normal operation, this panic is recovered and returned as a SERVFAIL response, but it can disrupt requests and increase panic logging. If the 'debug' plugin is active, it can cause the CoreDNS process to crash.
Users can upgrade to CoreDNS version 1.14.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb | [email protected] | Patch |
| https://github.com/coredns/coredns/pull/8207 | [email protected] | Issue TrackingPatch |
| https://github.com/coredns/coredns/releases/tag/v1.14.5 | [email protected] | Release Notes |
| https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coredns.io coredns | >= 1.9.4, < 1.14.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |