Resource exhaustion in CoreDNS - CVE-2026-32936
Published: April 25, 2026
Vulnerability identifier: #VU127723
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-32936
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the DoH GET request handling path in plugin/pkg/doh/doh.go when processing oversized dns= query parameters in requests to /dns-query. A remote attacker can send repeated oversized DoH GET requests to cause a denial of service.
The requests are rejected only after substantial URL query parsing, unescaping, base64 decoding, and DNS message unpacking work has already occurred.
Affected software
CoreDNS
How to mitigate CVE-2026-32936
Install security update from vendor's website.
CoreDNS - update to 1.14.3