Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Azure CoreDNS can be exhausted by DoQ traffic

published 6 months ago
Summary

Versions of Azure CoreDNS before 1.14.3 can be overwhelmed by a remote user who sends many tiny DNS‑over‑QUIC requests. The server creates a new processing thread for each request and can run out of memory, potentially crashing the service. Upgrade CoreDNS to version 1.14.3 or later to stop this from happening.

What to do
  • Update azure coredns to version 1.11.4-17.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure coredns < 1.11.4-17
Fix: upgrade to 1.11.4-17
Original advisory text
CVE-2026-32934 affecting package coredns for versions less than 1.11.4-17
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.
References
Timeline
Published5 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-85728 · OSV
Track software like this
Free during beta