CVE-2024-0874: CoreDNS Cache Information Disclosure Flaw

CVE-2024-0874 Overview

CoreDNS contains a caching implementation flaw that can return invalid cache entries to DNS clients. The issue is tracked as [CWE-524] and stems from incorrect handling of cached DNS records within the plugin responsible for response caching. An unauthenticated network attacker can leverage the flaw to influence integrity of DNS responses returned from the resolver cache.

CoreDNS is the default DNS server in Kubernetes and is widely deployed in cloud-native environments, which broadens the operational impact of the flaw. Red Hat has shipped fixes across multiple advisories including RHSA-2024:0041, RHSA-2024:4850, RHSA-2024:6009, and RHSA-2024:6406.

Critical Impact
A remote, unauthenticated attacker can cause CoreDNS to serve invalid cached DNS records, undermining the integrity of name resolution for downstream applications.

Affected Products

CoreDNS (see upstream CoreDNS Issue #6186)
Red Hat OpenShift Container Platform distributions bundling CoreDNS
Kubernetes clusters embedding vulnerable CoreDNS builds

Discovery Timeline

2024-04-25 - CVE-2024-0874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0874

Vulnerability Analysis

CoreDNS caches DNS responses to reduce upstream lookups and improve query latency. The caching plugin evaluates whether a response is still valid based on its time-to-live (TTL) and other record metadata. The implementation in affected builds does not correctly validate the state of cached entries before returning them to clients.

As a result, the cache can serve records that should have been considered stale or invalid. Clients relying on CoreDNS receive answers that do not accurately reflect authoritative data. Because DNS integrity underpins service discovery, TLS name validation, and routing decisions, incorrect responses can cascade into broader application-level failures.

The flaw is categorized under [CWE-524] (Use of Cache Containing Sensitive Information / cache correctness issues). Exploitation does not require authentication or user interaction and can be triggered across the network by causing CoreDNS to cache the target records.

Root Cause

The root cause is an incorrect caching decision path in the CoreDNS cache plugin. See the upstream fix in CoreDNS Pull Request #6354 and the tracking discussion in CoreDNS Issue #6186 for the code-level detail of the caching logic that was corrected.

Attack Vector

An attacker sends or induces DNS queries that cause CoreDNS to store or return records handled by the flawed cache path. Subsequent legitimate queries then receive invalid answers from the cache. Details on the exact reproduction conditions are tracked in the Red Hat CVE record for CVE-2024-0874 and the corresponding Red Hat Bug Report #2219234.

No verified public exploit code is available for CVE-2024-0874.
Refer to the linked CoreDNS issue and pull request for technical details of the caching logic.

Detection Methods for CVE-2024-0874

Indicators of Compromise

Unexpected or inconsistent DNS answers returned by CoreDNS pods for records that resolve correctly against upstream authoritative servers.
DNS responses served by CoreDNS with TTL or record state that disagrees with the authoritative zone.
Client applications reporting intermittent name resolution errors that clear after a CoreDNS restart or cache flush.

Detection Strategies

Compare CoreDNS resolver answers against authoritative sources for representative internal and external zones on a scheduled basis.
Enable the CoreDNS log and errors plugins and correlate cache hits with anomalous response contents.
Inventory container images and Kubernetes clusters to identify CoreDNS versions predating the fix referenced in CoreDNS Pull Request #6354.

Monitoring Recommendations

Alert on discrepancies between CoreDNS query metrics (coredns_cache_hits_total, coredns_cache_misses_total) and application-level DNS failure rates.
Track advisory status via the Red Hat CVE page for CVE-2024-0874 and subscribe to CoreDNS release notes.
Monitor pod restarts and CoreDNS crash loops that may indicate cache-driven resolution problems.

How to Mitigate CVE-2024-0874

Immediate Actions Required

Upgrade CoreDNS to a release that includes the fix from CoreDNS Pull Request #6354.
On Red Hat platforms, apply the errata listed in RHSA-2024:0041, RHSA-2024:4850, RHSA-2024:6009, and RHSA-2024:6406 as applicable to the deployed product versions.
Rebuild and redeploy container images that embed CoreDNS from a base image containing the patched binary.

Patch Information

The upstream fix is available in CoreDNS via CoreDNS Pull Request #6354. Red Hat OpenShift and related products have received fixes through the advisories referenced above. Consult the Red Hat CVE record for CVE-2024-0874 for the definitive product-to-errata mapping.

Workarounds

Reduce the CoreDNS cache TTL in the Corefile to minimize the window during which invalid entries can be served.
Temporarily disable the cache plugin in Corefile for zones where response integrity is critical, accepting the additional upstream query load.
Flush the CoreDNS cache on a scheduled interval as a short-term compensating control until patched builds are deployed.

bash

# Example Corefile with reduced cache TTL as a temporary mitigation
. {
    forward . /etc/resolv.conf
    cache 30
    log
    errors
}