CVE-2026-82399 coredns CVE debrief

Who should care

Defenders responsible for CoreDNS instances, especially those exposed to untrusted networks, should prioritize patching to prevent potential memory exhaustion attacks. This includes operators managing DNS infrastructure, platform administrators overseeing network security, vulnerability management teams assessing risk exposure, and security teams monitoring for potential threats. Prioritizing patching and reviewing network configurations can help mitigate

Why it matters

CVE-2026-82399 is a high-severity vulnerability in CoreDNS that allows unauthenticated clients to potentially exhaust memory and terminate CoreDNS. Defenders should prioritize patching CoreDNS instances, especially those exposed to untrusted networks, to prevent potential memory exhaustion attacks.

• Memory exhaustion and potential termination of CoreDNS
• Increased risk of denial-of-service attacks
• Potential impact on DNS resolution availability

Technical summary

The vulnerability affects the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in CoreDNS, allowing an unauthenticated client to amplify allocation and potentially exhaust memory and terminate CoreDNS. The ordinary UDP and TCP listeners are not affected. This issue arises from the dns.Msg.Unpack function being called on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header, enabling an unauthenticated client to amplify allocation before the plugin chain. This can lead to potential memory exhaustion attacks if not mitigated.

Defensive priority

Defenders should prioritize patching CoreDNS instances, especially those exposed to untrusted networks, to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Patch CoreDNS instances to version 1.14.7
• Review and update network configurations to limit exposure
• Monitor CoreDNS logs for potential memory exhaustion attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the dns.Msg.Unpack function being called on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc validates the fixed header. This allows an unauthenticated client to amplify allocation before the plugin chain, potentially exhausting memory and terminating CoreDNS.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.