-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the TCP message processing loop in CoreDns (src/dns/coredns.rs). The original code used a while let Some(message) loop with hickory_stream.next().await, which processed TCP requests serially without timeouts. The patch added a 3-second timeout wrapper and limited to one message per connection. The absence of these protections in vulnerable versions allowed connection starvation. The file/module structure and commit diff directly point to this function as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aardvark-dns | rust | >= 1.12.0, < 1.12.2 | 1.12.2 |