CVE-2026-82399: CoreDNS DNS-over-HTTPS/QUIC/gRPC DoS Vulnerability

CVE-2026-82399 Overview

CoreDNS is a widely deployed DNS server written in Go and used as the default cluster DNS in Kubernetes. CVE-2026-82399 is an unauthenticated denial-of-service vulnerability affecting the encrypted transport handlers in CoreDNS versions prior to 1.14.7. The DNS-over-HTTPS (DoH), DNS-over-HTTP/3, DNS-over-QUIC (DoQ), and DNS-over-gRPC request paths call dns.Msg.Unpack on attacker-controlled section counts before header validation. A remote attacker can amplify memory allocation using DNS name compression and inflated section counts, exhausting server memory and terminating the process. The standard UDP and TCP listeners are not affected because they validate the fixed header first.

Critical Impact
An unauthenticated remote attacker can crash CoreDNS instances exposed via DoH, DoH3, DoQ, or DNS-over-gRPC, disrupting DNS resolution for dependent workloads including Kubernetes clusters.

Affected Products

CoreDNS versions prior to 1.14.7
Deployments exposing DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, or DNS-over-gRPC listeners
Kubernetes clusters and service meshes using vulnerable CoreDNS builds for encrypted DNS

Discovery Timeline

2026-09-16 - CVE-2026-82399 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82399

Vulnerability Analysis

The flaw resides in the encrypted DNS transport handlers implemented in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go. These paths invoke dns.Msg.Unpack on incoming messages before dns.DefaultMsgAcceptFunc validates the fixed DNS header. Because unpacking runs first, attacker-supplied section counts in the question, answer, authority, and additional sections drive allocation decisions without any sanity check. This is an uncontrolled resource consumption weakness [CWE-770].

Message parsing occurs prior to the plugin chain, so any plugin-level rate limiting configured by operators cannot throttle these requests. Concurrent unauthenticated messages amplify memory pressure until the Go runtime terminates the CoreDNS process. The ordinary UDP and TCP servers escape the issue because they call the acceptance function on the header before unpacking full sections.

Root Cause

The root cause is ordering: dns.Msg.Unpack executes before header validation on the encrypted transports. Combined with DNS name compression pointers, small wire payloads expand into large in-memory structures, producing an allocation amplification primitive.

Attack Vector

An unauthenticated remote client sends crafted DNS messages over DoH, DoH3, DoQ, or gRPC. Each message declares excessive section counts and leverages compression to inflate parsed content. Sustained concurrent requests exhaust server memory and crash the daemon.

// Patch excerpt: core/dnsserver/server_grpc.go
 	"github.com/coredns/caddy"
 	"github.com/coredns/coredns/pb"
+	"github.com/coredns/coredns/plugin/pkg/dnsutil"
 	"github.com/coredns/coredns/plugin/pkg/reuseport"
 	"github.com/coredns/coredns/plugin/pkg/transport"

// Patch excerpt: core/dnsserver/server_quic.go
 	"time"
 	"github.com/coredns/coredns/plugin/metrics/vars"
+	"github.com/coredns/coredns/plugin/pkg/dnsutil"
 	clog "github.com/coredns/coredns/plugin/pkg/log"

Source: GitHub CoreDNS Commit 530b0a5. The patch introduces the dnsutil helper into the QUIC and gRPC server files to validate DNS headers before invoking dns.Msg.Unpack.

Detection Methods for CVE-2026-82399

Indicators of Compromise

Sudden CoreDNS process restarts or OOMKilled events on pods exposing DoH, DoH3, DoQ, or gRPC listeners.
Sharp spikes in resident memory of CoreDNS containers with no corresponding rise in legitimate query volume.
Malformed or oversized encrypted DNS requests originating from a small number of source addresses.

Detection Strategies

Inspect encrypted DNS request payload sizes and section counts at the load balancer or ingress layer for anomalies.
Alert on CoreDNS runtime metrics showing go_memstats_alloc_bytes growth without proportional query counts on standard listeners.
Correlate Kubernetes pod restart events for CoreDNS deployments with upstream client connection patterns.

Monitoring Recommendations

Track CoreDNS Prometheus metrics for the dns_request_size_bytes and per-plugin request counters segmented by transport.
Enable structured logs on ingress proxies fronting CoreDNS DoH endpoints and retain them for retrospective analysis.
Monitor container exit codes and last-state reasons in orchestrators to identify repeated crash-loop patterns.

How to Mitigate CVE-2026-82399

Immediate Actions Required

Upgrade CoreDNS to version 1.14.7 or later across all clusters and standalone deployments.
Inventory ingress paths that expose CoreDNS DoH, DoH3, DoQ, or gRPC listeners to untrusted networks.
Restart CoreDNS pods after upgrade to ensure vulnerable binaries are replaced.

Patch Information

The fix is available in CoreDNS 1.14.7. See the GitHub Security Advisory GHSA-mrg3-qvqr-jw29 and the CoreDNS v1.14.7 Release Notes. The code change is committed in GitHub CoreDNS Commit 530b0a5 and adds header validation via the dnsutil package before message unpacking on encrypted transports.

Workarounds

Disable the DoH, DoH3, DoQ, and gRPC server blocks in the Corefile until the upgrade is applied.
Restrict access to encrypted DNS listeners using network policies, firewalls, or mTLS-enforcing gateways.
Place a validating reverse proxy in front of CoreDNS that enforces DNS message size limits and drops malformed requests.

bash

# Example: verify the running CoreDNS version and upgrade in Kubernetes
kubectl -n kube-system get deployment coredns -o jsonpath='{.spec.template.spec.containers[0].image}'
kubectl -n kube-system set image deployment/coredns coredns=coredns/coredns:1.14.7
kubectl -n kube-system rollout status deployment/coredns