CVE-2026-62994

Name of the Vulnerable Software and Affected Versions CoreDNS versions 1.9.4 through 1.14.4

Description A network DNS client authorized to request AXFR (Zone Transfer) can trigger a panic in the server. This occurs when CoreDNS is configured with k8s external headless-service zone transfers and Kubernetes contains a headless service endpoint without declared ports. The issue stems from plugin/kubernetes/object/endpoint.go creating a Port: -1, which is then skipped by plugin/k8s external/msg to dns.go. Consequently, plugin/k8s external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go attempts to index records[0] without verifying that the batch is non-empty.

Recommendations Update to version 1.14.5.