CVE-2026-62299: CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record
CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.
Other sources
CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.4-18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.4-20 - Upgrade
Upgrade
coredns/rewrite-pluginto a version that resolves this vulnerability.Fixed in 1.14.5 - Compensating control
Temporarily limit CoreDNS exposure to unauthenticated clients by restricting network access to the CoreDNS UDP/TCP DNS ports (53) at the firewall/load balancer until the CoreDNS upgrade to 1.14.5 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62299?
The severity of CVE-2026-62299 is categorized as medium with a CVSS score of 5.3.
What are the potential impacts of CVE-2026-62299?
CVE-2026-62299 can lead to a remote denial-of-service (DoS) when certain conditions are met.
How do I fix CVE-2026-62299?
To fix CVE-2026-62299, you should upgrade CoreDNS to version 1.14.5 or later.
What is the nature of the vulnerability in CVE-2026-62299?
CVE-2026-62299 is a null pointer dereference vulnerability found in the CoreDNS rewrite plugin when handling EDNS0 responses.
Who is affected by CVE-2026-62299?
CVE-2026-62299 affects users of CoreDNS versions prior to 1.14.5.