7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26018

CVE-2026-26018: CoreDNS Loop Detection Denial of Service Vulnerability

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26018

CVE-2026-26018:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coredns/coredns	go	< 1.14.2	1.14.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in the CoreDNS loop plugin, caused by a combination of predictable random number generation and a fatal error handler. The analysis of commit 7ae1c40db200a29d8160707bcffb232c53a2005c reveals the core of the fix.

Predictable Token Generation: The function qname in plugin/loop/setup.go was identified as the source of the vulnerability. It used Go's math/rand package seeded with time.Now().UnixNano(). This method of seeding is predictable, allowing an attacker to guess the 'random' query name used by the loop detection mechanism.
Exploitable Crash Condition: The (*Loop).ServeDNS method in plugin/loop/loop.go, as detailed in the vulnerability description, contains the logic that triggers the crash. It increments a counter for any incoming DNS query whose name matches the predictable name generated by qname. Upon the third match, it calls log.Fatalf.
Process Termination: The log.Fatalf call results in an immediate os.Exit(1), terminating the entire CoreDNS process and causing a denial of service. An attacker can repeatedly trigger this to create a crash-restart loop.

The patch addresses the root cause by modifying the qname function to use the cryptographically secure crypto/rand package. This makes the query name unpredictable, preventing the attacker from being able to trigger the crash condition in (*Loop).ServeDNS. Both qname (the source of the vulnerability) and (*Loop).ServeDNS (the runtime trigger of the exploit) are the key functions involved.

Vulnerable functions

qname

plugin/loop/setup.go

This function generated a predictable 'random' query name using a pseudo-random number generator (math/rand) seeded with the server's start time. This allowed an attacker to guess the query name and trigger a denial of service. The patch replaced this with a cryptographically secure random number generator.

(*Loop).ServeDNS

plugin/loop/loop.go

This method handles incoming DNS queries and compares them against the predictable query name generated by `qname`. When it receives three matching queries from an attacker, it calls `log.Fatalf`, which unconditionally terminates the CoreDNS process via `os.Exit(1)`. This function would be present in the stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.