Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-62994
3.7 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): Low (L)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): Low (L)
Activity log
- Created suggestion
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
References
-
https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv x_refsource_CONFIRM
-
https://github.com/coredns/coredns/pull/8207 x_refsource_MISC
-
https://github.com/coredns/coredns/releases/tag/v1.14.5 x_refsource_MISC
Affected products
coredns
- ==>= 1.9.4, < 1.14.5
Package maintainers
-
@rtreffer Rene Treffer <treffer+nixos@measite.de>
-
@rushmorem Rushmore Mushambi <rushmore@webenchanter.com>
-
@DeltaEvo Duarte David <deltaduartedavid@gmail.com>
-
@johanot Johan Thomsen <write@ownrisk.dk>
-
@djds djds <git@djds.dev>