CVE-2026-62994: CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
CoreDNS k8sexternal headless AXFR can emit an empty transfer batch that panics the transfer plugin
Other sources
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8sexternal/msgtodns.go skips that service, plugin/k8sexternal/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.4-20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62994?
The severity of CVE-2026-62994 is rated low at 3.7.
How do I fix CVE-2026-62994?
To fix CVE-2026-62994, upgrade CoreDNS to version 1.14.6 or later.
What systems are affected by CVE-2026-62994?
CVE-2026-62994 affects CoreDNS versions 1.9.4 through 1.14.5.
What type of vulnerability is CVE-2026-62994?
CVE-2026-62994 is a vulnerability that can cause a panic in the transfer plugin due to an empty transfer batch.
What is the impact of CVE-2026-62994?
The impact of CVE-2026-62994 can lead to service disruptions caused by CoreDNS crashing.