CoreDNS versions prior to 1.14.2 are vulnerable to a denial of service attack that can crash the DNS server, potentially leading to widespread network resolution outages.

The vulnerability resides in the loop detection plugin, where the use of a predictable pseudo-random number generator combined with an improper fatal error handler allows an unauthenticated remote attacker to trigger a process termination.

A successful exploitation of this vulnerability results in a denial of service, rendering the DNS server unavailable for all dependent systems. Given that DNS is a foundational service for network connectivity, this disruption poses a high risk to business continuity and operational stability. The CVSS score of 7.5 reflects the high impact on availability, despite the lack of confidentiality or integrity compromise.

Immediate Action: Update the CoreDNS installation to version 1.14.2 or later to apply the necessary security patches.

Proactive Monitoring: Monitor server logs for an unusual frequency of process restarts or high volumes of malformed DNS queries that may indicate an attempt to trigger the loop detection crash.

Compensating Controls: Implement rate limiting and traffic filtering at the network perimeter to drop suspicious or malformed DNS traffic before it reaches the CoreDNS service.

Public Exploit Available: No (exploit_available: unknown)

The severity of this issue is significant due to the critical role DNS plays in infrastructure availability. Organizations running CoreDNS must prioritize upgrading to version 1.14.2 immediately to eliminate the risk of service disruption. Ensure that all deployment pipelines are updated to reference the patched version to prevent accidental reintroduction of the vulnerable code.