Detections
Analytics

Echo: github.com/coredns/coredns: security update to 1.12.2

high Tenable Cloud Security Plugin ID 465108

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS)
 vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously
 created a new goroutine for every incoming QUIC stream without imposing any limits on the number of
 concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams,
 leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash —
 especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two
 key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection
 with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool
 to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine
 model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available
 for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://`
 block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage,
 and/or monitor QUIC connection patterns and alert on anomalies. (CVE-2025-47950)

Solution

Update the github.com/coredns/coredns library and its related packages to version 1.12.2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2025-47950

Plugin Details

Severity: High

ID: 465108

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-47950

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/24/2025

Vulnerability Publication Date: 6/6/2025

Reference Information

CVE: CVE-2025-47950