{"id":"EUVD-2026-45018","revision":"348faf61379d4115bb0aaad9c3ef5753","records":[{"revision":"348faf61379d4115bb0aaad9c3ef5753","observedAt":"2026-11-03T12:05:03.251+00:00","statement":{"source":"euvd","id":"EUVD-2026-45018","aliases":["CVE-2026-62994","GHSA-74w3-63xv-x9mv"],"title":"CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes …","description":"CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7,"severity":null}],"references":["https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv","https://github.com/coredns/coredns/pull/8207","https://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb","https://github.com/coredns/coredns/releases/tag/v1.14.5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45018","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 16, 2026, 7:39:05 PM","dateUpdated":"Jul 17, 2026, 11:12:51 AM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-62994","title":"CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin","vulnerabilityIds":["CVE-2026-62994"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-45018","identifiers":["EUVD-2026-45018","CVE-2026-62994","GHSA-74w3-63xv-x9mv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}