CVE-2026-32936

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.3

Description CoreDNS is a DNS server that chains plugins. A denial-of-service issue exists in the DNS-over-HTTPS (DoH) GET path because it lacks early size validation for incoming requests. Specifically, the server accepts oversized values for the dns query parameter and performs expensive operations—including URL query parsing, base64 decoding, and DNS message unpacking—before rejecting the request. In contrast, the POST path utilizes http.MaxBytesReader to limit reads to 65536 bytes.

A remote, unauthenticated attacker can exploit this by sending repeated oversized DoH GET requests to the /dns-query endpoint. This forces high CPU usage, large transient memory allocations, and elevated garbage-collection pressure (the process of reclaiming memory used by the application), leading to a denial of service. The vulnerable logic is located in the requestToMsgGet() and base64ToMsg() functions within plugin/pkg/doh/doh.go.

Recommendations Update CoreDNS to version 1.14.3. As a temporary mitigation, restrict access to the /dns-query endpoint or limit the size of incoming GET requests at the network or load balancer level.