CVE-2026-62994— CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
Possible ATT&CK Techniques 1AI
T1498.002 · Reflection AmplificationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-62994
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
Source: NVD (National Vulnerability Database)
Vulnerability Description
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
未捕获的异常
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-62994
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62994
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-62994 (2)
Vendor Advisories for CVE-2026-62994 (1)
Same Patch Batch · coredns · 2026-07-16 · 3 CVEs total
| CVE-2026-62309 | 7.5 HIGH | CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte |
| CVE-2026-62299 | 5.3 MEDIUM | CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downst |
IV. Related Vulnerabilities
Same product: coredns
- CVE-2026-62299
CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer pa - CVE-2026-62309
CoreDNS: proxyproto plugin panics on PPv2 datagram with non- - CVE-2026-35579
CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and D - CVE-2026-33489
CoreDNS transfer plugin subzone ACL bypass via lexicographic - CVE-2026-32936
CoreDNS DoH GET path missing size validation causes CPU and
Same vendor: coredns
- CVE-2026-62299
CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer pa - CVE-2026-62309
CoreDNS: proxyproto plugin panics on PPv2 datagram with non- - CVE-2026-35579
CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and D - CVE-2026-33489
CoreDNS transfer plugin subzone ACL bypass via lexicographic - CVE-2026-32936
CoreDNS DoH GET path missing size validation causes CPU and
Same weakness: CWE-248
- CVE-2026-47480
NVIDIA Triton Inference Server 异常处理不当漏洞 - CVE-2026-48069
@grpc/grps-js: An incoming malformed compressed message can - CVE-2026-48068
@grpc/grps-js: A malformed request can cause a server crash - CVE-2026-48038
joi: Uncaught RangeError on deeply nested input through recu - CVE-2026-50328
Windows Server Update Service (WSUS) Tampering Vulnerability
V. Comments for CVE-2026-62994
No comments yet