CVE-2026-62299

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5.

• CWE-476

• https://github.com/coredns/coredns/commit/fc447d0658b093edc8cd29a6b171216a44a644c2Patch
• https://github.com/coredns/coredns/pull/8190Issue Tracking, Patch
• https://github.com/coredns/coredns/releases/tag/v1.14.5Release Notes
• https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7Exploit, Third Party Advisory
• https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7Exploit, Third Party Advisory

Published

Jul 16, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62293HAPI FHIR is a complete implementation of the HL7 FHIR stand…5
• CVE-2026-62294Flameshot is powerful yet simple to use screenshot software.…5.1
• CVE-2026-62295HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-62296HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-62297ag-psd is a JavaScript library for reading and writing Photo…7.5
• CVE-2026-62298mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN…0
• CVE-2026-6230The Tainacan plugin for WordPress is vulnerable to time-base…7.5
• CVE-2026-62300Filecoin Pin is an IPFS Pinning Service API implementation t…6.5
• CVE-2026-62301MyTube is a self-hosted downloader and player for several vi…7.1
• CVE-2026-62302MyTube is a self-hosted downloader and player for several vi…8.7
• CVE-2026-62303Pistache is a high-performance REST toolkit written in C++. …5.9
• CVE-2026-62308Tugtainer is a self-hosted app for automating updates of Doc…9.1