CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://` block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies.

An update of the coredns package has been released.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0485 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-47950:
    CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS)     vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously     created a new goroutine for every incoming QUIC stream without imposing any limits on the number of     concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams,     leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash     especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two     key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection     with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool     to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine     model and ensures that CoreDNS remains resilient under high concurrency.  Some workarounds are available     for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://`     block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage,     and/or monitor QUIC connection patterns and alert on anomalies.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of coredns installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47950 advisory.

  - CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS)     vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously     created a new goroutine for every incoming QUIC stream without imposing any limits on the number of     concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams,     leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash     especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two     key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection     with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool     to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine     model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available     for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://`     block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage,     and/or monitor QUIC connection patterns and alert on anomalies. (CVE-2025-47950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of coredns installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47950 advisory.

  - CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS)     vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously     created a new goroutine for every incoming QUIC stream without imposing any limits on the number of     concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams,     leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash     especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two     key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection     with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool     to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine     model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available     for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://`     block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage,     and/or monitor QUIC connection patterns and alert on anomalies. (CVE-2025-47950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
332678	Photon OS 5.0: Coredns PHSA-2025-5.0-91-0541	Nessus	PhotonOS Local Security Checks	Local	high
332431	Photon OS 5.0: Coredns PHSA-2026-5.0-90-0869	Nessus	PhotonOS Local Security Checks	Local	high
321475	Photon OS 5.0: Coredns PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	Local	high
276172	TencentOS Server 4: coredns (TSSA-2025:0485)	Nessus	Tencent Local Security Checks	Local	high
241912	Azure Linux 3.0 Security Update: coredns (CVE-2025-47950)	Nessus	Azure Linux Local Security Checks	Local	high
241895	CBL Mariner 2.0 Security Update: coredns (CVE-2025-47950)	Nessus	MarinerOS Local Security Checks	Local	high
241059	Photon OS 4.0: Coredns PHSA-2025-4.0-0823	Nessus	PhotonOS Local Security Checks	Local	high
241058	Photon OS 5.0: Coredns PHSA-2025-5.0-0541	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2025-47950

high

Tenable Plugins

high

high

high

high

high

high

high

high