CVE-2025-68151
📋 TL;DR
CoreDNS servers running gRPC, HTTPS, or HTTP/3 protocols are vulnerable to denial-of-service attacks due to missing resource limits. Unauthenticated attackers can crash or degrade server performance by flooding connections, streams, or sending oversized requests. This affects all CoreDNS deployments using these protocols before version 1.14.0.
💻 Affected Systems
- CoreDNS
📦 What is this software?
Coredns by Coredns.io
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage with CoreDNS crashing, disrupting all DNS resolution for dependent services
Likely Case
Performance degradation and intermittent service disruption affecting DNS reliability
If Mitigated
Minimal impact with proper network controls and monitoring in place
🎯 Exploit Status
Simple DoS attack requiring only network access to vulnerable ports
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.14.0
Vendor Advisory: https://github.com/coredns/coredns/security/advisories/GHSA-527x-5wrf-22m2
Restart Required: Yes
Instructions:
1. Update CoreDNS to version 1.14.0 or later
2. Restart CoreDNS service
3. Verify the new version is running
🔧 Temporary Workarounds
Network ACL Restrictions
linuxRestrict access to CoreDNS gRPC/HTTPS/HTTP/3 ports to trusted sources only
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Connection Rate Limiting
linuxUse system-level connection rate limiting to mitigate flood attacks
iptables -A INPUT -p tcp --dport 443 -m limit --limit 10/second --limit-burst 20 -j ACCEPT
🧯 If You Can't Patch
- Disable gRPC, HTTPS, and HTTP/3 server types if not required
- Implement network-level DDoS protection and connection rate limiting
🔍 How to Verify
Check if Vulnerable:
Check CoreDNS version and enabled plugins: coredns -version | grep -E 'CoreDNS-1\.(0-13|14\.0)'Check Version:
coredns -versionVerify Fix Applied:
Confirm version is 1.14.0 or later: coredns -version📡 Detection & Monitoring
Log Indicators:
- Unusual connection spikes
- Memory exhaustion warnings
- Server restart/crash logs
Network Indicators:
- High volume of connections to gRPC/HTTPS/HTTP/3 ports
- Abnormal request sizes
SIEM Query:
source="coredns" AND ("out of memory" OR "panic" OR "connection flood")