---
id: CVE-2026-32936
title: >-
  github.com/coredns/coredns: CoreDNS: Denial of Service via oversized
  DNS-over-HTTPS GET requests (CVE-2026-32936)
summary: >-
  A flaw was found in CoreDNS, a DNS server that chains plugins. A remote,
  unauthenticated attacker can exploit this vulnerability by repeatedly sending
  oversized DNS-over-HTTPS (DoH) GET requests. The GET path, unlike the POST
  path, lacks s…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-1284
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2.14
affected:
  - advanced_cluster_management_for_kubernetes 2.14
patched:
  - advanced_cluster_management_for_kubernetes 2.14
published: '2026-05-05'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T23:22:28+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32936.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32936.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-32936'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2466869'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-32936'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32936'
  - url: 'https://github.com/coredns/coredns/releases/tag/v1.14.3'
  - url: 'https://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwr'
  - url: 'https://access.redhat.com/errata/RHSA-2026:25127'
  - url: 'https://github.com/coredns/coredns'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00672
epssPercentile: 0.51864
aliases:
  - GHSA-63cw-r7xf-jmwr
  - GO-2026-5164
ecosystem: go
ingestedAt: '2026-09-12T03:13:01.757Z'
---

## Overview

A flaw was found in CoreDNS, a DNS server that chains plugins. A remote, unauthenticated attacker can exploit this vulnerability by repeatedly sending oversized DNS-over-HTTPS (DoH) GET requests. The GET path, unlike the POST path, lacks size validation before processing large `dns=` query parameter values. This can lead to high CPU usage, significant memory allocations, and increased garbage collection, resulting in a Denial of Service (DoS).

## Vendor advisories

- **RHSA-2026:25127** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:25127)

**github.com/coredns/coredns: CoreDNS: Denial of Service via oversized DNS-over-HTTPS GET requests** — rated Moderate by Red Hat. Released 2026-05-05, updated 2026-10-16.

Fixed:

- Red Hat Advanced Cluster Management for Kubernetes 2.14

Not affected:

- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat OpenShift Container Platform 4

## Remediation

For release note details, see the upstream Submariner release notes:

https://submariner.io/community/releases/

Downstream-specific issues resolved:
* ACM-27238
* ACM-28294
* ACM-28295
* ACM-28311
* ACM-28313
* ACM-28314
* ACM-28315
* ACM-28316
* ACM-28329
* ACM-28331
* ACM-28333
* ACM-28335
* ACM-28337
* ACM-28339
* ACM-28342
* ACM-29317
* ACM-29511
* ACM-29613
* ACM-29614
* ACM-29631
* ACM-29632
* ACM-29633
* ACM-29634
* ACM-29776
* ACM-30134
* ACM-30726
* ACM-30727
* ACM-30728
* ACM-30729
* ACM-30970
* ACM-31136
* ACM-31831
* ACM-31840
* ACM-32575
* ACM-32842
* ACM-34108
* ACM-34586
* ACM… https://access.redhat.com/errata/RHSA-2026:25127

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-32936)

Affected packages:

- `github.com/coredns/coredns < 1.14.3`

Patched in:

- `github.com/coredns/coredns 1.14.3`

Source: https://osv.dev/vulnerability/GHSA-63cw-r7xf-jmwr