CVE-2026-62299

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.5

Description The rewrite plugin in this DNS server fails to perform a nil check when dereferencing the *dns.OPT returned by res.IsEdns0() within the edns0SetResponseRule and edns0ReplaceResponseRule functions in plugin/rewrite/edns0.go. This occurs when a downstream plugin returns a response lacking an OPT record. A remote, unauthenticated client can trigger this by sending a DNS query that matches a rewrite edns0 rule with a revert flag. This can lead to a panic in ResponseReverter within plugin/rewrite/reverter.go, resulting in a SERVFAIL response and degraded availability, or a complete process crash if the debug directive disables recovery.

Recommendations Update to version 1.14.5.