CVE-2026-32936High· 7.5▾ TwilightA flaw was found in CoreDNS, a DNS server that chains plugins. A remote, unauthenticated attacker can exploit this vulnerability by repeatedly sending oversized DNS-over-HTTPS (DoH) GET requests. The GET path, unlike the POST path, lacks s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.7%
Last analysed / modified upstream
A flaw was found in CoreDNS, a DNS server that chains plugins. A remote, unauthenticated attacker can exploit this vulnerability by repeatedly sending oversized DNS-over-HTTPS (DoH) GET requests. The GET path, unlike the POST path, lacks size validation before processing large dns= query parameter values. This can lead to high CPU usage, significant memory allocations, and increased garbage collection, resulting in a Denial of Service (DoS).
github.com/coredns/coredns: CoreDNS: Denial of Service via oversized DNS-over-HTTPS GET requests — rated Moderate by Red Hat. Released 2026-05-05, updated 2026-10-16.
Fixed:
Not affected:
For release note details, see the upstream Submariner release notes:
https://submariner.io/community/releases/
Downstream-specific issues resolved:
Workarounds / mitigations:
Affected packages:
github.com/coredns/coredns < 1.14.3Patched in:
github.com/coredns/coredns 1.14.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116172Medium· 5.9vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface (CVE-2026-116172)
CVE-2026-45856High· 7.0kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
CVE-2026-103484High· 8.8IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.
CVE-2026-32665High· 7.5unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length (CVE-2026-32665)
CVE-2026-59317Medium· 6.5DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apach…
CVE-2026-12185Medium· 6.5In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check