CVE-2026-32934: 
NixOS vulnerability analysis and mitigation

CVE-2026-32934 is a Denial-of-Service vulnerability in CoreDNS's DNS-over-QUIC (DoQ) server caused by unbounded goroutine and memory growth. An unauthenticated remote attacker can open many QUIC streams and send only 1 byte per stream, exhausting server memory and triggering an OOM-kill. It affects all CoreDNS versions prior to 1.14.3. The vulnerability was published on April 25, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, CoreDNS Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in core/dnsserver/server_quic.go. CoreDNS's DoQ server uses a global worker pool (streamProcessPool) to limit concurrent stream processing, but when the pool is full, it still spawns an additional goroutine per accepted stream to wait for a worker token — creating an unbounded backlog. Compounding this, active workers block indefinitely in io.ReadFull() with no per-stream read deadline: an attacker sends exactly 1 byte, causing io.ReadFull() to block waiting for the second byte of the DoQ 2-byte length prefix, pinning all workers. This is noted as a regression/incomplete fix for CVE-2025-47950 (GHSA-cvx7-x8pj-x2gw). No authentication or special privileges are required to trigger the condition (CoreDNS Advisory).

Successful exploitation results in unbounded goroutine and RSS memory growth on the CoreDNS server, ultimately causing an out-of-memory kill and complete service outage. The impact is limited to availability — there is no confidentiality or integrity impact. Because CoreDNS is widely used as the default DNS server in Kubernetes clusters, a crash can disrupt DNS resolution for all workloads in the affected cluster, potentially causing broad service degradation or outages across dependent applications (CoreDNS Advisory, Github Advisory).

A Python proof-of-concept script (doq-dos-repro.py) is publicly referenced in the official security advisory, demonstrating goroutine and RSS memory exhaustion by opening 60 connections with 256 streams each (15,360 total streams), growing goroutines from 17 to 15,557 and RSS from ~49 MB to ~138 MB (CoreDNS Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.24–0.26%, and the vulnerability is not listed in the CISA KEV catalog. Detection plugins are available in Nessus (plugin 313705) and Qualys (Github Advisory).

1. Reconnaissance: Identify CoreDNS instances with DNS-over-QUIC (DoQ) enabled and exposed on UDP port 853 (or configured DoQ port) using network scanning tools such as Nmap or Shodan, targeting versions prior to 1.14.3.
2. Establish QUIC connections: Using the PoC script or a custom QUIC client, open a large number of QUIC connections to the target CoreDNS server (e.g., 60 connections).
3. Open many streams per connection: For each connection, open the maximum number of QUIC streams (e.g., 256 streams per connection, totaling ~15,360 streams).
4. Send partial DoQ message: On each stream, send exactly 1 byte — this causes the CoreDNS worker's io.ReadFull() call to block indefinitely waiting for the second byte of the 2-byte DoQ length prefix, pinning all worker goroutines.
5. Exhaust goroutine pool: As the worker pool fills, CoreDNS spawns additional waiter goroutines for each new accepted stream with no upper bound, causing unbounded goroutine and memory growth.
6. Trigger OOM-kill: Sustain the open streams until the server's memory is exhausted, causing the OS to OOM-kill the CoreDNS process and resulting in a DNS service outage (CoreDNS Advisory).

• Network: Unusually high number of simultaneous QUIC connections to the CoreDNS DoQ port (default UDP/853) from one or few source IPs; streams that remain open indefinitely without completing a DNS query.
• Process: Rapid growth in the number of goroutines in the CoreDNS process (observable via /metrics endpoint — go_goroutines metric spiking from baseline ~17 to thousands); RSS memory of the CoreDNS process growing continuously without bound.
• Logs: CoreDNS OOM-kill events in system logs (e.g., kernel oom_kill_process messages referencing the CoreDNS binary); CoreDNS crash/restart entries in container or systemd logs.
• Metrics: go_goroutines counter in CoreDNS Prometheus metrics rising sharply; process RSS memory (process_resident_memory_bytes) growing rapidly during the attack window (CoreDNS Advisory).

The only fix is to upgrade CoreDNS to version 1.14.3 or later, which avoids spawning waiter goroutines when the QUIC worker pool is full and addresses the unbounded stream backlog (CoreDNS Release). The fix is tracked in pull request #7927 (core: Avoid spawning waiter goroutines when QUIC worker pool is full). No configuration-based workarounds exist; disabling the DoQ transport entirely is the only alternative mitigation if upgrading is not immediately possible (CoreDNS Advisory).

The vulnerability was reported by researcher manizada and published by CoreDNS maintainer yongtang on April 25, 2026. The advisory notes this is a regression from an incomplete fix for the prior CVE-2025-47950, highlighting the challenge of fully remediating resource exhaustion issues in QUIC-based servers. No significant broader media coverage or notable social media discussion beyond automated CVE tracking feeds has been identified (CoreDNS Advisory).