CVE-2026-62994
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.
CSIRTS triage
- What
- The `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin.
- Who is affected
- Deployments of CoreDNS using the `k8s_external` headless AXFR feature.
- Urgency
- Remediation is low urgency as the severity is low and exploitation is not reported.
- Action
- No specific action is required at this time.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-62994
Get an email if CVE-2026-62994 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-62994)