ZeroDay Findings
Sign inSign up

Findings

CVE-2025-68151

CoreDNS is a DNS server that chains plugins.

Published Jan 8, 2026 · updated Oct 14, 2026 · coredns.io coredns

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints. Version 1.14.0 contains a patch.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 8, 2026 · NIST NVD

    Detected

    CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (

  2. Oct 14, 2026 · NIST NVD

    Updated

    CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (

Affected

  • cpe coredns.io/corednsversion unspecified

Sources

  • CVE.orgCVE-2025-68151

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-68151

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDCVE-2025-68151

    CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many

    nvd.nist.gov

References