CVE-2025-68151

Katalog CVE

CVSS 7.5 · High EPSS 0,49%

Kerentanan Allocation of Resources Without Limits or Throttling pada coredns.io coredns. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints. Version 1.14.0 contains a patch.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/coredns/coredns/commit/0d8cbb1a6bcb6bc9c1a489865278b8725fa20812 patch
• https://github.com/coredns/coredns/pull/7490 issue tracking · patch
• https://github.com/coredns/coredns/security/advisories/GHSA-527x-5wrf-22m2 advisory pihak ketiga