{"id":"EUVD-2026-45018","enisaUuid":"d5846275-cf3c-3c2c-8100-d371f8d771f8","description":"CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.","datePublished":"Jul 16, 2026, 7:39:05 PM","dateUpdated":"Jul 17, 2026, 11:12:51 AM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv\nhttps://github.com/coredns/coredns/pull/8207\nhttps://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb\nhttps://github.com/coredns/coredns/releases/tag/v1.14.5\n","aliases":"CVE-2026-62994\nGHSA-74w3-63xv-x9mv\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"d8457eb0-0e5f-3c56-8e1f-1352fb41a516","product":{"name":"coredns","vendor":{"name":"coredns"}},"product_version":"1.9.4, \u003c 1.14.5"}],"enisaIdVendor":[{"id":"52731371-6d1c-3955-b415-38b9c2d16395","vendor":{"name":"coredns"}}],"enisaIdVulnerability":[{"id":"58f348f7-a764-3786-bf26-7ec4bd9fa0ab","vulnerability":{"id":"CVE-2026-62994","description":"CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.","datePublished":"Jul 16, 2026, 7:39:05 PM","dateUpdated":"Jul 17, 2026, 11:12:51 AM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv\nhttps://github.com/coredns/coredns/pull/8207\nhttps://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb\nhttps://github.com/coredns/coredns/releases/tag/v1.14.5\n","enisa_id":"EUVD-2026-45018\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Nov 3, 2026, 7:14:44 AM","vulnerabilityProduct":[{"id":"76c96c56-4675-3fd7-948e-a10b63feaaea","product":{"name":"coredns","vendor":{"name":"coredns"}},"product_version":"1.9.4, \u003c 1.14.5"}],"vulnerabilityVendor":[{"id":"3241ebdf-5407-36f2-9d8c-589600849bc0","vendor":{"name":"coredns"}}]}},{"id":"f2f5fb55-2cca-3aba-95e6-615abd757306","vulnerability":{"id":"GHSA-74w3-63xv-x9mv","description":"CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin","datePublished":"Oct 16, 2026, 7:26:42 PM","dateUpdated":"Oct 16, 2026, 7:26:42 PM","baseScore":0.0,"references":"https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62994\nhttps://github.com/coredns/coredns/pull/8207\nhttps://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb\nhttps://github.com/coredns/coredns\nhttps://github.com/coredns/coredns/releases/tag/v1.14.5\n","enisa_id":"EUVD-2026-45018\n","aliases":"GHSA-74w3-63xv-x9mv\nCVE-2026-62994\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"c12415fc-3a9d-38a3-996c-724fbeaf7d3f","advisory":{"id":"msrc_CVE-2026-62994","description":"CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin","datePublished":"Jul 23, 2026, 1:02:50 AM","dateUpdated":"Aug 9, 2026, 1:40:20 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-62994.json\n","aliases":"CVE-2026-62994\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"2356865d-df01-3de1-8de3-47a314567db9","product":{"name":"azl3 coredns 0:1.11.4-20.azl3","vendor":{"name":"Microsoft"}}},{"id":"3751c7b8-0a25-3202-ab71-1a02544f5ed7","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"6212759e-8f11-3e76-abfd-7022f9290860","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"a9d56909-cef3-3e49-8711-ac35705dbbae","product":{"name":"coredns","vendor":{"name":"coredns"}}}]}}]}