CVE-2026-62309

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.4

Description A crash can occur in the CoreDNS process when the proxyproto plugin is enabled. The issue arises when a single 28-byte UDP datagram containing a PROXY v2 header with a non-UDP transport (such as family byte 0x11) is processed. Specifically, the PacketConn.ReadFrom function in plugin/pkg/proxyproto/proxyproto.go handles the header incorrectly; after parseProxyProtocol returns an error, the addr variable is reassigned from a nil readFrom result. The process then crashes when addr.String() is called in the warning log before the ServeDNS recovery mechanism can intervene.

Recommendations Update to version 1.14.4. As a temporary mitigation, disable the proxyproto plugin.