CVE-2026-86003highCWE-441

CVE-2026-86003: high-severity vulnerability in coredns

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

Published · Updated

Follow this CVE+ Monitor coredns+ Monitor github.com/coredns/coredns

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.4%
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the proxy or forward plugin passes unchanged to an update-capable upstream. If that upstream trusts CoreDNS's source address or connection and does not require an attacker-unknown end-to-end TSIG, the request appears to originate from CoreDNS and can add, replace, or delete DNS records, redirect traffic, take over names, alter mail routing, or disrupt the writable zone. This issue is fixed in version 1.14.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
coredns · coredns
Related CVEs — coredns

In the same product, most dangerous first.

CVE-2026-26018HIGHCoreDNS Loop Detection Denial of Service VulnerabilityEPSS 1.2%CVE-2025-47950HIGHCoreDNS Vulnerable to DoQ Memory Exhaustion via Stream AmplificationEPSS 1.2%CVE-2026-32936HIGHCoreDNS DoH GET path missing size validation causes CPU and memory amplificationEPSS 0.7%CVE-2026-62309HIGHCoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoSEPSS 0.7%CVE-2026-35579HIGHCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportsEPSS 0.6%CVE-2026-82399HIGHCoreDNS: Unauthenticated memory exhaustion in custom transportsEPSS 0.6%