CVE-2026-62299

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.

• CWE-476

• https://github.com/coredns/coredns/commit/fc447d0658b093edc8cd29a6b171216a44a644c2Patch
• https://github.com/coredns/coredns/pull/8190Issue Tracking, Patch
• https://github.com/coredns/coredns/releases/tag/v1.14.5Release Notes
• https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7Exploit, Third Party Advisory
• https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7Exploit, Third Party Advisory

Published

Jul 16, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6229The Royal Elementor Addons plugin for WordPress is vulnerabl…7.2
• CVE-2026-62290cert-manager adds certificates and certificate issuers as re…7.3
• CVE-2026-62293HAPI FHIR is a complete implementation of the HL7 FHIR stand…5
• CVE-2026-62294Flameshot is powerful yet simple to use screenshot software.…5.1
• CVE-2026-62295HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-62296HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-6230The Tainacan plugin for WordPress is vulnerable to time-base…7.5
• CVE-2026-62309CoreDNS is a DNS server written in Go. Prior to 1.14.4, a si…7.5
• CVE-2026-6231The bson_validate function may return early on specific inpu…7.5
• CVE-2026-623129Router is an AI router & token saver. Prior to 0.5.2, 9Rout…8.8
• CVE-2026-62314Anubis is a Web AI Firewall Utility that challenges users' c…5.8
• CVE-2026-62323Cloudreve is a self-hosted file management and sharing syste…6.3