Younevsky

**Name of the Vulnerable Software and Affected Versions** CoreDNS versions prior to 1.14.2 **Description** A logical flaw exists due to the default execution order of plugins, where security plugins such as `acl` are evaluated before the `rewrite` plugin. This creates a Time-of-Check Time-of-Use (TOCTOU) flaw—a race condition where a resource is checked but then modified before it is used—allowing attackers to bypass DNS access controls. In multi-tenant Kubernetes clusters, this can undermine DNS-based segmentation, enabling unauthorized service discovery and reconnaissance of restricted internal infrastructure by mapping public names to internal services after the access control check has passed. **Recommendations** Update to version 1.14.2. Reorder the default `plugin.cfg` so that `rewrite` and other normalization plugins run before `acl`, `opa`, and `firewall`. Ensure all access control checks are applied after name normalization.

**Name of the Vulnerable Software and Affected Versions** CoreDNS versions prior to 1.14.2 **Description** A denial of service issue exists in the loop detection plugin of CoreDNS. A remote attacker can crash the DNS server by sending specially crafted DNS queries. The flaw is caused by the use of a predictable pseudo-random number generator (PRNG) to create a secret query name `qname` in the `qname()` function within `plugin/loop/setup.go`. This predictability allows an attacker to guess the `qname` if they know the server start time or have access to logs during network degradation. When the server receives three or more matching HINFO queries, the `ServeDNS()` function in `plugin/loop/loop.go` triggers a fatal error handler `Fatalf()` in `plugin/pkg/log/log.go`, which calls `os.Exit(1)` and immediately terminates the process. Since CoreDNS is the default DNS server for Kubernetes, this can lead to cluster-wide DNS resolution failure and cascading service disruptions. **Recommendations** Update CoreDNS to version 1.14.2 or later. As a temporary mitigation, restrict access to the loop detection plugin or monitor logs for unusual HINFO query patterns to detect exploitation attempts.