CVE-2026-62299 coredns CVE debrief

Who should care

Users of CoreDNS versions prior to 1.14.5 should be aware of this vulnerability and take steps to mitigate it. The affected operators are those who manage CoreDNS deployments, and the affected platforms are those that use CoreDNS for DNS resolution. The vulnerability-management teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. The security teams should monitor CoreDNS logs for signs of exploitation and implement compensating controls to detect and prevent malicious DNS queries.

Technical summary

The CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag. Two response rules, edns0SetResponseRule and edns0ReplaceResponseRule, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery.

Defensive priority

Medium

Recommended defensive actions

• Update to CoreDNS version 1.14.5 or later
• Implement compensating controls to detect and prevent malicious DNS queries
• Monitor CoreDNS logs for signs of exploitation
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-16T20:16:46.693Z and has not been modified since then. The NVD entry is currently 5.3 MEDIUM. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record.

Official resources