ZeroDay Findings
Sign inSign up

Findings

CVE-2026-62994

CoreDNS headless AXFR can emit an empty transfer batch that panics the plugin

Published Oct 16, 2026 · corrected/updated Oct 16, 2026 · evidence confidence high

### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in transferer can emit an empty batch, and the shared plugin indexes without checking that the batch is non-empty. In normal CoreDNS mode the panic is recovered and returned as , but repeated triggering can disrupt requests and amplify panic logging; if the plugin disables recovery, the same path can crash the CoreDNS process. ### Details assumes that every emits only non-empty batches. During AXFR/IXFR response generation it indexes without checking the slice length: - The built-in transferer violates that contract for headless services whose endpoints have no declared ports. sends the SRV result slice unconditionally: - intentionally skips services whose port is : - The Kubernetes EndpointSlice conversion creates that sentinel when an EndpointSlice has no ports: - This creates a built-in source-to-sink chain: 1. Kubernetes EndpointSlice has ready addresses and no ports. 2. CoreDNS converts it to an endpoint with . 3. with includes that service in transfer data. 4. sends an empty SRV batch. 5. indexes and panics. Suggested remediation: 1. In , skip or reject empty batches before indexing . 2. In , only send when in the headless endpoint and port/protocol paths. 3. Add regression tests covering headless services and empty transfer batches. Example consumer-side guard: ### PoC Safe local unit-level reproduction was performed. It does not contact external infrastructure and does not require a live Kubernetes cluster. #### Reproducer A: the sink panics on an empty batch A temporary package test was added under : Verification command and result: #### Reproducer B: the built-in transferer emits the empty batch A temporary package test was added under : Verification command and result: Additional focused verification: Affected pac

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-62994 is a low public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: github.com/coredns/coredns (1.9.4 → 1.14.5). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 3.7. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-248, CWE-755. Sources contributing to this record: github, go_vulndb, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in transferer can emit an empty batch, and the shared plugin indexes without checking that the batch is non-empty. In normal CoreDNS mode the panic is rec

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/coredns/coredns fixed in 1.14.5

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/coredns/coredns fixed in 1.14.5

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in transferer can emit an empty batch, and the shared plugin indexes without checking that the batch is non-empty. In normal CoreDNS mode the panic is rec

Affected

  • Go github.com/coredns/coredns1.9.4 → 1.14.5

Sources

References