CVE-2026-26018

HIGH

CoreDNS <1.14.2 - DoS

Title source: llm

Description

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.

References (2)

[Release Notes] https://github.com/coredns/coredns/releases/tag/v1.14.2

[Vendor Advisory] https://github.com/coredns/coredns/security/advisories/GHSA-h75p-j8xm-m278

Scores

CVSS v3 7.5

EPSS 0.0004

EPSS Percentile 11.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-337 CWE-770 CWE-400

Status published

Affected Products (2)

coredns/coredns < 1.14.2Go

coredns.io/coredns < 1.14.2

Timeline

Published Mar 06, 2026

Tracked Since Mar 06, 2026