Listen to this Post
This vulnerability exploits the lack of resource-limiting controls in CoreDNS’s gRPC, HTTPS, and HTTP/3 server implementations. For the gRPC, HTTPS, and HTTP/3 servers, there are no enforced limits on the number of concurrent connections or active streams per connection. An attacker can open a flood of parallel connections or rapidly create new streams within a single connection, allocating memory for each. Concurrently, the gRPC server accepts Protobuf messages up to ~4MB by default, far exceeding the DNS protocol’s 64KB maximum. By sending many concurrent, oversized gRPC requests, or combining connection floods with valid requests on other fronts, an attacker can cause uncontrolled memory allocation. This exhausts the server’s available RAM, leading to severe performance degradation, a complete crash, or termination by the system’s Out-Of-Memory (OOM) killer, resulting in a reliable Denial of Service.
dailycve form:
Platform: CoreDNS
Version: < 1.14.0
Vulnerability: DoS via exhaustion
Severity: Critical
date: 2025
Prediction: 2025-10-17
What Undercode Say:
Simulate connection flood for HTTP/3/HTTPS
for i in {1..10000}; do
curl -k https://target-dns:443/dns-query -m 1 &
done
Test gRPC message size limit (using grpcurl)
grpcurl -plaintext -d @ target-dns:443 coredns.DnsService.Query <<< "$(generate_large_payload)"
// Code snippet showing missing limit enforcement
// In plugin/grpc/server.go (simplified)
func (g GRPC) ServeDNS(ctx context.Context, req pb.DnsMessage) {
// No validation on req.Size() against max DNS size (65535)
// Default max receive message size is ~4GB (grpc.MaxRecvMsgSize)
processRequest(req) // Large payload consumes memory.
}
How Exploit:
1. Target CoreDNS with gRPC/HTTPS/HTTP3 enabled.
2. For DoS: Flood with parallel connections/streams.
- For gRPC: Send concurrent oversized (>64KB) protobuf messages.
4. Exhaust memory, causing crash/OOM kill.
Protection from this CVE
Update to CoreDNS v1.14.0+.
Configure upstream middleware limits.
Implement network-level rate limiting.
Impact:
Unauthenticated remote DoS.
Service disruption.
Memory exhaustion crashes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
