CVE-2026-62309highCWE-476

CVE-2026-62309: high-severity vulnerability in coredns

CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS

Published · Updated

Follow this CVE+ Monitor coredns

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
coredns · coredns
Related CVEs — coredns

In the same product, most dangerous first.

CVE-2026-26018HIGHCoreDNS Loop Detection Denial of Service VulnerabilityEPSS 1.2%CVE-2025-47950HIGHCoreDNS Vulnerable to DoQ Memory Exhaustion via Stream AmplificationEPSS 1.2%CVE-2026-32936HIGHCoreDNS DoH GET path missing size validation causes CPU and memory amplificationEPSS 0.7%CVE-2026-35579HIGHCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportsEPSS 0.6%CVE-2026-82399HIGHCoreDNS: Unauthenticated memory exhaustion in custom transportsEPSS 0.6%CVE-2026-62299MEDIUMCoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT recordEPSS 0.5%