CVE-2026-62994: CoreDNS Vulnerability in k8s_external Headless AXFR Leading to Panic
Summary
CVE-2026-62994: CoreDNS k8s_external headless AXFR can emit an empty transfer batch that panics the transfer plugin. Affects github.com/coredns/coredns versions >= 1.9.4, < 1.14.5. Fixed in 1.14.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CoreDNS is a flexible and extensible DNS server that is widely used in cloud-native environments, particularly with Kubernetes. It provides various plugins to enhance its functionality, including the k8s_external plugin, which facilitates DNS resolution for Kubernetes services. This vulnerability arises when CoreDNS is configured to handle headless service zone transfers, which can lead to unexpected behavior if certain conditions are met.
Vulnerability Detail
The vulnerability occurs in the CoreDNS transfer plugin when it processes AXFR requests for zones configured with the k8s_external plugin. If a headless service endpoint in Kubernetes has no declared ports, the k8s_external transferer can emit an empty batch of DNS records. The transfer plugin does not check if the batch is empty before accessing its first element, leading to a panic. This can disrupt DNS requests and cause log amplification. In normal operation, CoreDNS recovers from the panic and returns a SERVFAIL response, but if the debug plugin is enabled, the panic can crash the CoreDNS process entirely.
How To Fix
Latest published version: v1.15.0 as of 22 Oct 2026
go get github.com/coredns/coredns@v1.15.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.14.5
This is the first release that contains the fix.
go get github.com/coredns/coredns@v1.14.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the transfer plugin code to skip empty record batches. For example, in the 'plugin/transfer/transfer.go' file, add a check before indexing records:
for records := range pchan {
if len(records) == 0 {
continue;
}
if x, ok := records[0].(*dns.SOA); ok && soa == nil {
soa = x;
}
...
}
Conclusion
The CoreDNS vulnerability CVE-2026-62994 poses a risk when handling AXFR requests for headless services in Kubernetes. By updating to the patched version and implementing the recommended checks, users can mitigate the risk of service disruptions.
See every vulnerability recorded for github.com/coredns/coredns →
FAQ
A network client can trigger a panic in CoreDNS when requesting AXFR for affected zones, potentially disrupting DNS services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
CoreDNS versions up to 1.14.4 are affected. Updating to version 1.14.5 or later will resolve the issue.
Implement the suggested workaround to prevent empty record batches from causing panics in the transfer plugin.
The CVSS score for this vulnerability is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/coredns/coredns.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
