CVE-2026-26018

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.2

Description A denial of service issue exists in the loop detection plugin of CoreDNS. A remote attacker can crash the DNS server by sending specially crafted DNS queries. The flaw is caused by the use of a predictable pseudo-random number generator (PRNG) to create a secret query name qname in the qname() function within plugin/loop/setup.go. This predictability allows an attacker to guess the qname if they know the server start time or have access to logs during network degradation. When the server receives three or more matching HINFO queries, the ServeDNS() function in plugin/loop/loop.go triggers a fatal error handler Fatalf() in plugin/pkg/log/log.go, which calls os.Exit(1) and immediately terminates the process. Since CoreDNS is the default DNS server for Kubernetes, this can lead to cluster-wide DNS resolution failure and cascading service disruptions.

Recommendations Update CoreDNS to version 1.14.2 or later. As a temporary mitigation, restrict access to the loop detection plugin or monitor logs for unusual HINFO query patterns to detect exploitation attempts.