High severity · published Jan 8, 2026
CVE-2025-68151
CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints. Version 1.14.0 contains a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
coredns · coredns
< 1.14.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68151
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68151
Patch
https://github.com/coredns/coredns/commit/0d8cbb1a6bcb6bc9c1a489865278b8725fa20812
Issue Tracking
https://github.com/coredns/coredns/pull/7490
Third Party Advisory
https://github.com/coredns/coredns/security/advisories/GHSA-527x-5wrf-22m2
More from coredns
9.8
CVE-2026-35579
CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports
7.5
CVE-2026-86003
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
7.5
CVE-2026-82399
CoreDNS: Unauthenticated memory exhaustion in custom transports
7.5
CVE-2026-62309
CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS
7.5
CVE-2026-33489
CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison