https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:07:12 +0000 https://db.gcve.eu/vuln/ghsa-cvx7-x8pj-x2gw <p><strong>Affected:</strong> Go: github.com/coredns/coredns</p> <p>### Summary</p> <p>A **Denial of Service (DoS)** vulnerability was discovered in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments.</p> <p>### Impact</p> <p>- **Component**: `server_quic.go` - **Attack Vector**: Remote, network-based - **Attack Complexity**: Low - **Privileges Required**: None - **User Interaction**: None - **Impact**: High availability loss (OOM kill or unresponsiveness)</p> <p>This issue affects deployments with `quic://` enabled in the Corefile. A single attacker can cause the CoreDNS instance to become unresponsive using minimal bandwidth and CPU.</p> <p>### Patches</p> <p>The patch introduces two key mitigation mechanisms:</p> <p>- **`max_streams`**: Caps the number of concurrent QUIC streams per connection. Default: `256`. - **`worker_pool_size`**: Introduces a server-wide, bounded worker pool to process incoming streams. Default: `1024`.</p> <p>This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. The new configuration options are exposed through the `quic` Corefile block:</p> <p>``` quic { max_streams 256 worker_pool_size 1024 } ```</p> <p>These default…</p> <p><strong>Affected:</strong> Go: github.com/coredns/coredns</p> <p>### Summary</p> <p>A **Denial of Service (DoS)** vulnerability was discovered in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments.</p> <p>### Impact</p> <p>- **Component**: `server_quic.go` - **Attack Vector**: Remote, network-based - **Attack Complexity**: Low - **Privileges Required**: None - **User Interaction**: None - **Impact**: High availability loss (OOM kill or unresponsiveness)</p> <p>This issue affects deployments with `quic://` enabled in the Corefile. A single attacker can cause the CoreDNS instance to become unresponsive using minimal bandwidth and CPU.</p> <p>### Patches</p> <p>The patch introduces two key mitigation mechanisms:</p> <p>- **`max_streams`**: Caps the number of concurrent QUIC streams per connection. Default: `256`. - **`worker_pool_size`**: Introduces a server-wide, bounded worker pool to process incoming streams. Default: `1024`.</p> <p>This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. The new configuration options are exposed through the `quic` Corefile block:</p> <p>``` quic { max_streams 256 worker_pool_size 1024 } ```</p> <p>These default…</p> https://db.gcve.eu/vuln/ghsa-cvx7-x8pj-x2gw