CVE-2026-32936

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.

• CWE-400

• https://github.com/coredns/coredns/releases/tag/v1.14.3Release Notes
• https://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwrExploit, Mitigation, Vendor Advisory
• https://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwrExploit, Mitigation, Vendor Advisory

Published

May 5, 2026

Last Modified

Jul 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32930Chamilo LMS is a learning management system. Prior to 1.11.3…7.1
• CVE-2026-32931Chamilo LMS is a learning management system. Prior to 1.11.3…8.8
• CVE-2026-32932Chamilo LMS is a learning management system. Prior to 1.11.3…6.1
• CVE-2026-32933AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-32934CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32935phpseclib is a PHP secure communications library. Projects u…5.9
• CVE-2026-32937free5GC is an open source 5G core network. free5GC CHF prior…6.5
• CVE-2026-32938SiYuan is a personal knowledge management system. In version…6.5
• CVE-2026-32939DataEase is an open source data visualization analysis tool.…8.1
• CVE-2026-3294An authentication logic vulnerability in multiple TP-Link ra…8.8
• CVE-2026-32940SiYuan is a personal knowledge management system. In version…6.1
• CVE-2026-32941Sliver is a command and control framework that uses a custom…6.5