CVE-2026-62994
Description
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
How to fix
- coredns.io coredns1.14.5 or later
- github.com/coredns/coredns1.14.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| coredns.io coredns | 1.9.4 ≤ v < 1.14.5 | 1.14.5 |
| github.com/coredns/corednsGo | 1.9.4 ≤ v < 1.14.5 | 1.14.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.