ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-62994

CoreDNS headless AXFR can emit an empty transfer batch that panics the plugin

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · CoreDNS headless AXFR can

Check if you run it

No confirmed exploitation is on record for CVE-2026-62994. EPSS is 0.46%. Act only if a listed version of CoreDNS headless AXFR can is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (CoreDNS headless AXFR can).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low3.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.46%
Remediation
Version ranges on file
Affected products
Go github.com/coredns/coredns · go github.com/coredns/coredns · golang github.com

### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in transferer can emit an empty batch, and the shared plugin indexes without checking that the batch is non-empty. In normal CoreDNS mode the panic is recovered and returned as , but repeated triggering can disrupt requests and amplify panic logging; if the plugin disables recovery, the same path can crash the CoreDNS process. ### Details assumes that every emits only non-empty batches. During AXFR/IXFR response generation it indexes without checking the slice length: - The built-in transferer violates that contract for headless services whose endpoints have no declared ports. sends the SRV result slice unconditionally: - intentionally skips services whose port is : - The Kubernetes EndpointSlice conversion creates that sentinel when an EndpointSlice has no ports: - This creates a built-in source-to-sink chain: 1. Kubernetes EndpointSlice has ready addresses and no ports. 2. CoreDNS converts it to an endpoint with . 3. with includes that service in transfer data. 4. sends an empty SRV batch. 5. indexes and panics. Suggested remediation: 1. In , skip or reject empty batches before indexing . 2. In , only send when in the headless endpoint and port/protocol paths. 3. Add regression tests covering headless services and empty transfer batches. Example consumer-side guard: ### PoC Safe local unit-level reproduction was performed. It does not contact external infrastructure and does not require a live Kubernetes cluster. #### Reproducer A: the sink panics on an empty batch A temporary package test was added under : Verification command and result: #### Reproducer B: the built-in transferer emits the empty batch A temporary package test was added under : Verification command and result: Additional focused verification: Affected pac

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/coredns/coredns1.9.4 → 1.14.5
  • go github.com/coredns/coredns>= 1.9.4, <= 1.14.4
  • golang github.comversion unspecified

How to fix CVE-2026-62994

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-62994. EPSS is 0.46%. Act only if a listed version of CoreDNS headless AXFR can is installed.

Which versions are affected?

Compare what you have installed with 1.9.4 → 1.14.5, >= 1.9.4, <= 1.14.4. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-248; CWE-755: Improper Handling of Exceptional Conditions. EPSS 0.46%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Kubernetes security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in transferer can emit an empty batch, and the shared plugin indexes without checking that the batch is non-empty. In normal CoreDNS mode the panic is rec

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/coredns/coredns fixed in 1.14.5

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    github.com/coredns/coredns fixed in 1.14.5

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in transferer can emit an empty batch, and the shared plugin indexes without checking that the batch is non-empty. In normal CoreDNS mode the panic is rec

Sources

  • CVE.orgVulnerability recordCVE-2026-62994

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-62994

    30-day exploitation probability 0.5%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-74w3-63xv-x9mv

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-62994

    A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8s_external transferer can emit an empty []dns.RR batch, and the shared transfer plugin indexes records[0] without checking that the batch is non-emp

    advisories.gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-74w3-63xv-x9mv

    CoreDNS headless AXFR can emit an empty transfer batch that panics the plugin

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-74w3-63xv-x9mv

    CoreDNS headless AXFR can emit an empty transfer batch that panics the plugin

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.