CVE-2026-82399

CoreDNS before 1.14.7 unpacks attacker-controlled DNS messages before the fixed-header validation performed by dns.DefaultMsgAcceptFunc on its DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths (plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, core/dnsserver/server_grpc.go). An unauthenticated client can abuse DNS name compression with inflated DNS section counts to trigger excessive memory allocation before the plugin chain runs. By sustaining enough concurrent requests, the attacker exhausts memory and terminates the CoreDNS process, and because allocation happens before the plugin chain, plugin-level rate limiting cannot prevent the denial of service. Only deployments exposing these non-default listeners are affected; the ordinary UDP and TCP listeners validate the header first and are not vulnerable. No in-the-wild exploitation, public proof-of-concept, or CISA KEV listing is currently known.

What to do: Upgrade to CoreDNS 1.14.7 or later. Audit Corefiles for quic://, https://, h3://, or grpc:// server blocks to determine exposure, and until patching, restrict those listeners to trusted clients via firewalling or allowlisting, noting that plugin-level rate limiting does not mitigate this flaw. UDP/TCP-only deployments can be deprioritized.