CVE-2026-26018
Denial of Service in CoreDNS Loop Detection Plugin
Publication date: 2026-03-06
Last updated on: 2026-03-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| coredns.io | coredns | to 1.14.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-337 | A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-26018 is a high-severity denial of service (DoS) vulnerability in CoreDNS's loop detection plugin affecting versions prior to 1.14.2."}, {'type': 'paragraph', 'content': 'The vulnerability arises because the plugin uses a predictable pseudo-random number generator (PRNG) seeded with the current time to generate a secret query name (qname). An attacker who can guess or observe this qname can send specially crafted DNS queries that cause the plugin to detect a forwarding loop.'}, {'type': 'paragraph', 'content': 'When the plugin detects three or more matching HINFO queries with the secret qname, it calls a fatal error handler that immediately terminates the CoreDNS process without cleanup or recovery, crashing the DNS server.'}] [1]
How can this vulnerability impact me? :
Exploitation of this vulnerability can cause complete DNS resolution failure within Kubernetes clusters using CoreDNS.
- The DNS server crashes and stops responding due to the fatal termination triggered by crafted queries.
- This leads to cascading service discovery failures across the cluster.
- Persistent attacks may cause crash-restart loops, resulting in broad application-level disruptions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for repeated HINFO DNS queries with the same secret query name (qname) generated by the CoreDNS loop detection plugin. An attacker sends three or more matching HINFO queries with a predictable qname to trigger the denial of service.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts, you can inspect CoreDNS logs for repeated HINFO queries with identical qnames, especially if they occur in quick succession.'}, {'type': 'paragraph', 'content': 'Since the qname is generated using a predictable pseudo-random number generator seeded with the server start time, if you have access to logs, you can identify the qname values used in these queries.'}, {'type': 'paragraph', 'content': 'Suggested commands include using network packet capture tools to filter for HINFO DNS queries targeting your CoreDNS server, for example:'}, {'type': 'list_item', 'content': "tcpdump -i <interface> udp port 53 and 'udp[10] = 16' # Filters for DNS HINFO queries (type 16)"}, {'type': 'list_item', 'content': 'Alternatively, use tshark to filter and analyze DNS query types:'}, {'type': 'list_item', 'content': "tshark -i <interface> -Y 'dns.qry.type == 16' -T fields -e dns.qry.name"}, {'type': 'paragraph', 'content': 'Review the output for repeated identical qnames in HINFO queries, which may indicate an attempt to exploit the vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation is to upgrade CoreDNS to version 1.14.2 or later, where the vulnerability has been patched by fixing the predictable PRNG seeding and the fatal error handling.
Until the upgrade can be performed, consider restricting network access to the CoreDNS server to trusted sources only, to reduce the risk of an attacker sending crafted HINFO queries.
Additionally, monitor CoreDNS logs and network traffic for suspicious repeated HINFO queries as a temporary detection measure.