CVE-2026-62309: CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS
CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
corednsto a version that resolves this vulnerability.Fixed in 1.14.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62309?
CVE-2026-62309 has a high severity rating of 7.5.
How do I fix CVE-2026-62309?
To fix CVE-2026-62309, update CoreDNS to version 1.14.4 or later.
What type of attack does CVE-2026-62309 facilitate?
CVE-2026-62309 allows for a remote denial of service (DoS) attack on CoreDNS.
What versions of CoreDNS are affected by CVE-2026-62309?
CVE-2026-62309 affects versions of CoreDNS prior to 1.14.4.
What specific issue does CVE-2026-62309 cause in CoreDNS?
CVE-2026-62309 causes the CoreDNS process to panic when handling a PPv2 datagram with non-UDP transport.