CVE-2025-68151High· 7.5▾ TwilightCoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and d…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
0.5% → 0.5%
Last analysed / modified upstream
— → 7.5
medium → high
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints. Version 1.14.0 contains a patch.
coredns < 1.14.0Upgrade past the affected range:
coredns 1.14.0Affected packages:
github.com/coredns/coredns < 1.14.0Patched in:
github.com/coredns/coredns 1.14.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82399High· 7.5CoreDNS is a DNS server written in Go
CVE-2026-86003High· 7.5CoreDNS is a DNS server written in Go
CVE-2026-26018High· 7.5CoreDNS is a DNS server that chains plugins
CVE-2024-0874Medium· 5.3A flaw was found in coredns
CVE-2026-26017High· 7.7CoreDNS is a DNS server that chains plugins
CVE-2026-100350Medium· 5.3kin-openapi is a Go project for handling OpenAPI files