{"id":"EUVD-2025-33973","enisaUuid":"91fb0d9d-6257-3c3b-8710-aace96de4e80","description":"CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.","datePublished":"Sep 9, 2025, 7:27:18 PM","dateUpdated":"Sep 10, 2025, 2:26:13 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","references":"https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9\nhttps://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf\n","aliases":"CVE-2025-58063\nGHSA-93mf-426m-g6x9\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"d37249d8-d0a7-33a4-8c10-eb5a19b291a5","product":{"name":"coredns","vendor":{"name":"coredns"}},"product_version":"1.2.0, \u003c 1.12.4"}],"enisaIdVendor":[{"id":"38072756-7f64-33e1-a3ea-3f971a4ca9d2","vendor":{"name":"coredns"}}],"enisaIdVulnerability":[{"id":"86c09f67-1b85-37ee-95f4-1afd76f1b87d","vulnerability":{"id":"CVE-2025-58063","description":"CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.","datePublished":"Sep 9, 2025, 7:27:18 PM","dateUpdated":"Sep 10, 2025, 2:26:13 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","references":"https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9\nhttps://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf\n","enisa_id":"EUVD-2025-33973\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Oct 31, 2026, 7:14:15 AM","vulnerabilityProduct":[{"id":"261cebe8-fbe5-32a6-975c-4a084ee53216","product":{"name":"coredns","vendor":{"name":"coredns"}},"product_version":"1.2.0, \u003c 1.12.4"},{"id":"b32b8824-6b25-489c-9f3c-c2434a058521","product":{"name":"coredns","vendor":{"name":"coredns"}},"product_version":"1.2.0, \u003c 1.12.4"}],"vulnerabilityVendor":[{"id":"a9c8506b-f30b-3393-bceb-41c466ae36d0","vendor":{"name":"coredns"}}]}},{"id":"b10ed225-14fe-3704-9781-274f65dbca88","vulnerability":{"id":"GHSA-93mf-426m-g6x9","description":"CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion","datePublished":"Sep 9, 2025, 7:19:33 PM","dateUpdated":"Sep 10, 2025, 9:07:40 PM","baseScore":0.0,"references":"https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-58063\nhttps://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf\nhttps://github.com/coredns/coredns\n","enisa_id":"EUVD-2025-33973\n","aliases":"GHSA-93mf-426m-g6x9\nCVE-2025-58063\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:12:52 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"3b3c4f7e-56a6-3b6f-8ff9-d0b4cefdb68b","advisory":{"id":"openSUSE-SU-2025:15564-1","description":"govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media","datePublished":"Sep 18, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:42:03 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15564-1.json\nhttps://www.suse.com/security/cve/CVE-2025-4953/\nhttps://www.suse.com/security/cve/CVE-2025-54123/\nhttps://www.suse.com/security/cve/CVE-2025-54376/\nhttps://www.suse.com/security/cve/CVE-2025-58058/\nhttps://www.suse.com/security/cve/CVE-2025-58063/\nhttps://www.suse.com/security/cve/CVE-2025-58157/\nhttps://www.suse.com/security/cve/CVE-2025-58158/\nhttps://www.suse.com/security/cve/CVE-2025-58430/\nhttps://www.suse.com/security/cve/CVE-2025-58437/\nhttps://www.suse.com/security/cve/CVE-2025-58445/\nhttps://www.suse.com/security/cve/CVE-2025-58450/\nhttps://www.suse.com/security/cve/CVE-2025-59358/\nhttps://www.suse.com/security/cve/CVE-2025-59359/\nhttps://www.suse.com/security/cve/CVE-2025-59360/\nhttps://www.suse.com/security/cve/CVE-2025-59361/\nhttps://www.suse.com/security/cve/CVE-2025-7445/\nhttps://www.suse.com/security/cve/CVE-2025-8396/\nhttps://www.suse.com/security/cve/CVE-2025-9072/\nhttps://www.suse.com/security/cve/CVE-2025-9076/\nhttps://www.suse.com/security/cve/CVE-2025-9078/\nhttps://www.suse.com/security/cve/CVE-2025-9084/\n","aliases":"CVE-2025-4953\nCVE-2025-54123\nCVE-2025-54376\nCVE-2025-58058\nCVE-2025-58063\nCVE-2025-58157\nCVE-2025-58158\nCVE-2025-58430\nCVE-2025-58437\nCVE-2025-58445\nCVE-2025-58450\nCVE-2025-59358\nCVE-2025-59359\nCVE-2025-59360\nCVE-2025-59361\nCVE-2025-7445\nCVE-2025-8396\nCVE-2025-9072\nCVE-2025-9076\nCVE-2025-9078\nCVE-2025-9084\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1cc76f98-371a-3fc6-aee6-5eadf51878a2","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"29107cb4-f129-3481-ac9b-db60712e7317","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"29cdf64b-9d51-3131-8329-d2fe15008bbb","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"2e830e5b-5857-3f97-a80c-b3a30b97b6c2","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"610e85a2-a76d-3b52-ae27-3bf4aba41ec0","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"736c93eb-17d0-3c0d-9744-877b4b8ffc8d","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"ea17cf9d-e8f0-3a74-b23c-845080a781c5","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fb90779c-62f0-353d-b846-d907b8a69a19","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ff6a651c-8c7a-3ba4-be7f-c1564c968489","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"5d75ea29-f777-367f-b566-e688e906f1d7","advisory":{"id":"openSUSE-SU-2026:20099-1","description":"Security update for coredns","summary":"Security update for coredns","datePublished":"Jan 24, 2026, 9:09:32 AM","dateUpdated":"Sep 17, 2026, 5:26:04 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20099-1.json\nhttps://bugzilla.suse.com/1239294\nhttps://bugzilla.suse.com/1239728\nhttps://bugzilla.suse.com/1249389\nhttps://bugzilla.suse.com/1255345\nhttps://bugzilla.suse.com/1256411\nhttps://www.suse.com/security/cve/CVE-2024-51744/\nhttps://www.suse.com/security/cve/CVE-2025-58063/\nhttps://www.suse.com/security/cve/CVE-2025-68156/\nhttps://www.suse.com/security/cve/CVE-2025-68161/\n","aliases":"CVE-2024-51744\nCVE-2025-58063\nCVE-2025-68156\nCVE-2025-68161\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0835df47-01ca-3e02-862a-b0660f6577aa","product":{"name":"coredns-0:1.14.0-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"174191a6-4678-38ad-8249-6dd3b1b523bf","product":{"name":"coredns-0:1.14.0-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"40c8f309-d690-3d9a-8b5a-7a92e0cb1244","product":{"name":"coredns-1.14.0-bp160.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5699e580-636c-3ae9-9c9a-afbcad77a3ff","product":{"name":"coredns-1.14.0-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6532690a-eac5-33e5-b61b-602c9d665a38","product":{"name":"coredns-0:1.14.0-bp160.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"aabf8472-6e25-3729-a664-b98827a36807","product":{"name":"coredns-extras-0:1.14.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"b4f39d37-2fd0-3e26-9a8f-950277b1d157","product":{"name":"coredns-extras-1.14.0-bp160.1.1.noarch","vendor":{"name":"SUSE"}}},{"id":"c4a08ffb-b3b0-36e6-908b-046677915c59","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"f97067e5-21ba-3c58-b717-fcff40d114f1","product":{"name":"coredns-1.14.0-bp160.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"8ae53ff3-9a1f-381f-b58f-67807ee7b624","advisory":{"id":"WID-SEC-W-2025-2014","description":"CoreDNS: Schwachstelle ermöglicht Denial of Service","summary":"Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in CoreDNS ausnutzen, um einen Denial of Service Angriff durchzuführen.","datePublished":"Sep 9, 2025, 10:00:00 PM","dateUpdated":"Jan 25, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2014.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-2014\n","aliases":"CVE-2025-58063\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"9f4e3515-6814-3ed2-ad1f-5f86496b12a1","product":{"name":"coredns","vendor":{"name":"coredns"}}},{"id":"b7d1e4f5-dce7-3295-97ec-e0f60778c51d","product":{"name":"1.12.4","vendor":{"name":"open source"}}},{"id":"d9f1dbd9-b4a6-3674-8d81-1277a9696ffa","product":{"name":"SUSE openSUSE","vendor":{"name":"SUSE"}}}]}},{"id":"8d7b94df-ff11-3644-9a3f-1a3b80588fec","advisory":{"id":"msrc_CVE-2025-58063","description":"CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion","datePublished":"Sep 2, 2025, 12:00:00 AM","dateUpdated":"Sep 11, 2025, 1:01:49 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-58063.json\n","aliases":"CVE-2025-58063\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"01d7c757-222e-330d-9a24-7835c306e219","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"0f27485e-68a1-36a5-a18a-a4e5d65c2ff4","product":{"name":"\u003ccbl2 coredns 1.11.1-19","vendor":{"name":"Microsoft"}}},{"id":"256bd3b7-84b8-3d41-957c-b16495a5a6aa","product":{"name":"2.0","vendor":{"name":"Smiths Medical"}}},{"id":"26f996fb-ae91-3aaa-9d3c-77f8acfc2b7b","product":{"name":"\u003cazl3 coredns 1.11.4-8","vendor":{"name":"Microsoft"}}},{"id":"8e24f962-92b4-380d-9c54-18430d61c18f","product":{"name":"coredns","vendor":{"name":"coredns"}}},{"id":"9e7799e2-98b1-3708-910e-3383b9b2eac1","product":{"name":"cbl2 coredns 1.11.1-19","vendor":{"name":"Microsoft"}}},{"id":"b1105ae9-53f5-39d9-aced-978d890e2b9a","product":{"name":"azl3 coredns 1.11.4-8","vendor":{"name":"Microsoft"}}},{"id":"d3c11434-d48c-3005-908e-ddc4d3105570","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}},{"id":"a46f2f6b-77a6-3031-b7cf-97b1bf32935f","advisory":{"id":"openSUSE-SU-2025:15561-1","description":"coredns-1.12.4-2.1 on GA media","summary":"coredns-1.12.4-2.1 on GA media","datePublished":"Sep 18, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:41:59 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15561-1.json\nhttps://www.suse.com/security/cve/CVE-2025-58063/\n","aliases":"CVE-2025-58063\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"14b8fefa-8fc9-3c23-821f-6cb4c0269ad8","product":{"name":"coredns-extras-1.12.4-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1deec4a7-9e39-3807-a741-f97c6baec908","product":{"name":"coredns-extras-0:1.12.4-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"39f6030c-5740-3447-9b60-7bb6850d9137","product":{"name":"coredns-1.12.4-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"40968da6-3700-3913-ac46-af663e0fe454","product":{"name":"coredns-extras-0:1.12.4-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"48a43643-34a5-3602-8ba9-a91a73f12352","product":{"name":"coredns-1.12.4-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"52033708-1ab7-3d28-9260-b4ffb702bac9","product":{"name":"coredns-extras-1.12.4-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"52270a5e-a786-3de2-89d8-727599480035","product":{"name":"coredns-extras-1.12.4-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"598a6ed7-73e0-3682-be46-984e1d3ab340","product":{"name":"coredns-1.12.4-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"669a94d4-2341-3713-a651-1b19892ee327","product":{"name":"coredns-0:1.12.4-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6759c61b-bfa0-3e39-9b4e-46bded84852a","product":{"name":"coredns-0:1.12.4-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"72ce67da-26fb-3cf0-8b7e-92c710db039c","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"7b9f0213-156d-33f4-93ce-bf339049ff40","product":{"name":"coredns-1.12.4-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"885c5f3f-f4b1-3c81-81a1-2d85fcdaa023","product":{"name":"coredns-extras-1.12.4-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a398b9d5-3444-3f20-8193-6955a42e76b1","product":{"name":"coredns-0:1.12.4-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a7ca3cf6-77b7-372f-bc5e-69a9cb4ea051","product":{"name":"coredns-extras-0:1.12.4-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ede988ae-fcff-34c3-a772-ce113218c633","product":{"name":"coredns-extras-0:1.12.4-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f886d774-20fa-34ac-9ccf-d61395bad3b3","product":{"name":"coredns-0:1.12.4-2.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}