8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32934

CVE-2026-32934: CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32934

CVE-2026-32934:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coredns/coredns	go	< 1.14.3	1.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a resource exhaustion issue in CoreDNS's DNS-over-QUIC (DoQ) server. It's caused by a combination of two factors. First, the serveQUICStream function, which handles individual data streams, can be forced to block indefinitely by a client sending incomplete data (e.g., 1 byte). This is because the underlying read operation (readDOQMessage) waits for more data without a timeout. This allows an attacker to occupy all available worker goroutines in the processing pool. Second, and more critically, the serveQUICConnection function, which accepts new streams, would previously spawn a new 'waiter' goroutine for each new stream if the worker pool was already full. This behavior creates an unbounded number of goroutines, leading to memory exhaustion and a denial-of-service. The patch addresses this by changing serveQUICConnection to stop creating new goroutines when the pool is full. Instead, it now blocks until a worker is free or the connection is closed. Therefore, serveQUICConnection is the function containing the primary vulnerability logic (unbounded resource allocation), while serveQUICStream is the function that an attacker would target to block workers, making it a key runtime indicator during exploitation.

Vulnerable functions

dnsserver.ServerQUIC.serveQUICConnection

core/dnsserver/server_quic.go

This function is responsible for handling new DNS-over-QUIC connections. The vulnerability lies in the fact that when the worker pool is full, it spawns a new goroutine for each incoming stream to wait for a worker. A malicious client can exhaust the worker pool by opening many streams and keeping them busy, which leads to an unbounded number of waiting goroutines, causing a denial of service due to memory exhaustion.

dnsserver.ServerQUIC.serveQUICStream

core/dnsserver/server_quic.go

This function processes individual QUIC streams. While the unbounded goroutine allocation happens in `serveQUICConnection`, this is the function that would appear in a profiler's stack trace during an attack. An attacker can send a single byte to a stream, causing this function (specifically the `readDOQMessage` function it calls) to block indefinitely. This ties up a worker from the pool, enabling the resource exhaustion attack. Therefore, a high number of goroutines stuck in this function is a strong runtime indicator of exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.