How severe is CVE-2026-26018?

CVE-2026-26018 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-26018 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-26018?

CVE-2026-26018 affects Coredns.io Coredns. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-26018?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-26018 have an EU (EUVD) identifier?

Yes. CVE-2026-26018 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-10043.

When was CVE-2026-26018 published?

CVE-2026-26018 was published on 2026-03-06 and last updated on 2026-06-30.

CVE-2026-26018

CVE-2026-26018 is a high-severity vulnerability in Coredns.io Coredns with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-337.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (61st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-10043
Weakness: CWE-337
Affected product: Coredns.io Coredns
Published: 2026-03-06
Last modified: 2026-06-30

Description

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.

Frequently asked questions

What is CVE-2026-26018?: CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.
How severe is CVE-2026-26018?: CVE-2026-26018 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-26018 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-26018?: CVE-2026-26018 affects Coredns.io Coredns. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-26018?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-26018 have an EU (EUVD) identifier?: Yes. CVE-2026-26018 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-10043.
When was CVE-2026-26018 published?: CVE-2026-26018 was published on 2026-03-06 and last updated on 2026-06-30.

References

Affected products (1)

cpe:2.3:a:coredns.io:coredns:*:*:*:*:*:*:*:*

More vulnerabilities in Coredns.io Coredns

CVE-2026-35579 — Critical (CVSS 9.8): CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport…
CVE-2026-26017 — High (CVSS 7.7): CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS…
CVE-2026-33489 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL…
CVE-2026-33190 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on…
CVE-2026-32936 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts…
CVE-2026-32934 — High (CVSS 7.5): CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven…

All CVEs affecting Coredns.io Coredns →

Other CWE-337 vulnerabilities

CVE-2025-7770 — High (CVSS 8.7): Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are…
CVE-2025-55069 — High (CVSS 8.3): A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the…
CVE-2026-25235 — High (CVSS 7.5): PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable…
CVE-2025-62710 — Medium (CVSS 5.9): Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl…
CVE-2016-15006 — Low (CVSS 3.7): A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2. This issue affects the…
CVE-2025-20613 — Low (CVSS 3.3): Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an…

Browse all CWE-337 vulnerabilities →