Overview
The vulnerability identified as CVE-2025-47950 exposes a potential Denial of Service (DoS) attack vector in the CoreDNS DNS-over-QUIC (DoQ) server. This vulnerability affects versions of CoreDNS prior to 1.12.2. Given that CoreDNS is a widely used DNS server, this vulnerability could have significant implications for many internet systems, potentially leading to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-47950
Severity: High (CVSS: 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage due to Denial of Service (DoS)
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
CoreDNS | Prior to 1.12.2
How the Exploit Works
The vulnerability arises from the CoreDNS server’s handling of incoming QUIC streams. Previously, the server would create a new goroutine for every incoming QUIC stream without any limit. This could be exploited by a remote, unauthenticated attacker who could open a large number of concurrent streams. This would lead to uncontrolled memory consumption, potentially causing an Out Of Memory (OOM) crash, particularly in containerized or memory-constrained environments.
Conceptual Example Code
The following pseudocode illustrates how an attacker might exploit this vulnerability:
import quic
def exploit(target):
client = quic.Client()
client.connect(target)
for _ in range(1000000): # an excessive number of streams
stream = client.new_stream()
stream.send(b"malicious_packet")
exploit("target.example.com")In this example, the attacker creates an excessive number of QUIC streams, sending a packet on each one, to cause uncontrolled memory consumption and potentially an Out Of Memory (OOM) crash.
Mitigation Guidance
To mitigate this vulnerability, users should upgrade to CoreDNS version 1.12.2 or later, which introduces two key mitigation mechanisms: a cap on the number of concurrent QUIC streams per connection (`max_streams`) and a server-wide, bounded worker pool to process incoming streams (`worker_pool_size`).
For those unable to upgrade, possible workarounds include disabling QUIC support by removing or commenting out the `quic://` block in the Corefile, using container runtime resource limits to detect and isolate excessive memory usage, monitoring QUIC connection patterns and alerting on anomalies, or using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation.
