Vulnerability · Published Sep 9, 2025 · Assigned by GitHub_M
CVE-2025-58063CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion
High 7.1
In plain English
A high-severity security flaw in coredns from coredns. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/coredns/coredns | 1.12.4 | GHSA-93mf-426m-g6x9 |
| Go | github.com/coredns/coredns | 1.12.4 | GO-2025-3942 |
Affected products (as reported)
Weakness: CWE-681 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H