## CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

- 種別: advisory
- 重大度: low
- 関連技術: go, github, kubernetes
- CVE: CVE-2026-62994
- 公開日時: 2026-10-16T19:26:42.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-74w3-63xv-x9mv)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-74w3-63xv-x9mv

影響: go:github.com/coredns/coredns >= 1.9.4, <= 1.14.4 → 1.14.5
Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8s_external transferer can emit an empty []dns.RR batch, and the shared transfer plugin indexes records[0] without checking that the batch is non-empty. In normal CoreDNS mode the panic is recovered and returned as SERVFAIL, but repeated tr…