{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-05T19:07:51Z",
  "bugzilla" : {
    "description" : "github.com/coredns/coredns: CoreDNS: Denial of Service via oversized DNS-over-HTTPS GET requests",
    "id" : "2466869",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2466869"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-1284",
  "details" : [ "CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.", "A flaw was found in CoreDNS, a DNS server that chains plugins. A remote, unauthenticated attacker can exploit this vulnerability by repeatedly sending oversized DNS-over-HTTPS (DoH) GET requests. The GET path, unlike the POST path, lacks size validation before processing large `dns=` query parameter values. This can lead to high CPU usage, significant memory allocations, and increased garbage collection, resulting in a Denial of Service (DoS)." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.14",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25127",
    "cpe" : "cpe:/a:redhat:acm:2.14::el9",
    "package" : "rhacm2/lighthouse-agent-rhel9:1780204232"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.14",
    "release_date" : "2026-06-10T00:00:00Z",
    "advisory" : "RHSA-2026:25127",
    "cpe" : "cpe:/a:redhat:acm:2.14::el9",
    "package" : "rhacm2/lighthouse-coredns-rhel9:1780204249"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-coredns-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-32936\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32936\nhttps://github.com/coredns/coredns/releases/tag/v1.14.3\nhttps://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwr" ],
  "name" : "CVE-2026-32936",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}