CVE-2026-32934

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.

• CWE-770

• https://github.com/coredns/coredns/releases/tag/v1.14.3Release Notes
• https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5Exploit, Vendor Advisory
• https://github.com/coredns/coredns/security/advisories/GHSA-2wpx-qpw2-g5h5Exploit, Vendor Advisory

Published

May 5, 2026

Last Modified

Jul 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32929V-SFT versions 6.2.10.0 and prior contain an out-of-bounds r…5.5
• CVE-2026-3293A weakness has been identified in snowflakedb snowflake-jdbc…5.5
• CVE-2026-32930Chamilo LMS is a learning management system. Prior to 1.11.3…7.1
• CVE-2026-32931Chamilo LMS is a learning management system. Prior to 1.11.3…8.8
• CVE-2026-32932Chamilo LMS is a learning management system. Prior to 1.11.3…6.1
• CVE-2026-32933AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-32935phpseclib is a PHP secure communications library. Projects u…5.9
• CVE-2026-32936CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32937free5GC is an open source 5G core network. free5GC CHF prior…6.5
• CVE-2026-32938SiYuan is a personal knowledge management system. In version…6.5
• CVE-2026-32939DataEase is an open source data visualization analysis tool.…8.1
• CVE-2026-3294An authentication logic vulnerability in multiple TP-Link ra…8.8