CVE-2026-62299

Katalog CVE

CVSS 5.3 · Medium EPSS 0,54%

Kerentanan NULL Pointer Dereference pada coredns.io coredns. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/coredns/coredns/commit/fc447d0658b093edc8cd29a6b171216a44a644c2 patch
• https://github.com/coredns/coredns/pull/8190 issue tracking · patch
• https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7 exploit · advisory pihak ketiga
• https://github.com/coredns/coredns/releases/tag/v1.14.5 release notes