TI-2025-35906 Aliases CVE-2025-58063 GHSA-93mf-426m-g6x9

CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion

MEDIUM 64CWE-681Published 2025-09-09 · Updated 2025-09-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00506 43rd percentileScored 2026-11-07

Fix Partial coredns (coredns): 1.12.4github.com/coredns/coredns (Go): 1.12.4Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
coredns	coredns	1.2.0 to before 1.12.4	1.12.4	Patch available	CNA
—	github.com/coredns/coredns (Go)	1.2.0 to before 1.12.4	1.12.4	Patch available	GHSA-93mf-426m-g6x9

coredns Vendorcoredns Affected 1.2.0 to before 1.12.4 Fixed in 1.12.4 Patch available CNA
github.com/coredns/coredns (Go) Vendor— Affected 1.2.0 to before 1.12.4 Fixed in 1.12.4 Patch available GHSA-93mf-426m-g6x9

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:coredns.io:coredns::::::::	—	—	coredns

cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:* Versions — — ·coredns

Remediation

Fix · CNA coredns (coredns) Fixed in 1.12.4
Fix · GHSA-93mf-426m-g6x9 github.com/coredns/coredns (Go) Fixed in 1.12.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet: Fix deferred

Not affected: 1 product

Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2025-58063
2026-10-03 Alias added: GHSA-93mf-426m-g6x9

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-58063

Other 3

TI-2026-25615 CoreDNS TSIG authentication bypass on encrypted DNS transports CVSS 4.0HIGH 8.7
TI-2026-25384 CoreDNS DoH GET path missing size validation causes CPU and memory amplification CVSS 4.0HIGH 8.7
TI-2026-25382 CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service CVSS 4.0HIGH 8.7
TI-2026-27682 CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports CVSS 4.0HIGH 8.2
TI-2026-25885 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison CVSS 4.0HIGH 8.2
TI-2026-56816 CoreDNS: Unauthenticated memory exhaustion in custom transports CVSS 3.1HIGH 7.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences