8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32936

CVE-2026-32936: CoreDNS DoH GET path missing size validation causes CPU and memory amplification

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32936

CVE-2026-32936:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coredns/coredns	go	< 1.14.3	1.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the CoreDNS DNS-over-HTTPS (DoH) GET request handler. A remote, unauthenticated attacker can send a GET request to the /dns-query endpoint with an oversized dns query parameter, causing a denial of service.

The root cause is the lack of input validation before processing the dns parameter. The analysis of the provided patches and vulnerability description reveals the following flow:

The request is handled by the DoH.RequestToMsg function in plugin/pkg/doh/doh.go.
For GET requests, DoH.RequestToMsg calls the requestToMsgGet function.
The requestToMsgGet function extracts the dns query parameter from the URL. Before the patch, it did not perform any size checks on this parameter's value.
The potentially massive string is then passed to the base64ToMsg function.
base64ToMsg attempts to Base64 decode the entire string, which consumes a large amount of CPU and memory.

The patch, introduced in commit c967ab5c1c4882ab3c8e548118d53032709e812b, adds a size check in the requestToMsgGet function, rejecting requests with an oversized dns parameter before the expensive decoding operation is performed.

The identified vulnerable functions are those in this processing chain that would appear in a runtime profile during an attack. The profiling data in the advisory confirms that DoH.RequestToMsg, requestToMsgGet, and base64ToMsg are the key functions involved in the vulnerable execution path.

Vulnerable functions

DoH.RequestToMsg

plugin/pkg/doh/doh.go

This method is the entry point for the DoH plugin's request handling. It routes incoming GET requests to the `requestToMsgGet` function, initiating the vulnerable processing flow.

requestToMsgGet

plugin/pkg/doh/doh.go

This function extracts the 'dns' query parameter from a GET request. The vulnerability lies in its failure to validate the size of the parameter before passing it to the `base64ToMsg` function for decoding, which is corrected by the patch.

base64ToMsg

plugin/pkg/doh/doh.go

This function performs the resource-intensive base64 decoding of the user-provided 'dns' parameter. Because it was called without any prior size checks on its input, it could be forced to decode excessively large strings, leading to CPU and memory exhaustion.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.