From 6105a49b49f3123f1fe65a69fbba7ad5afc1ef0b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 6 Jun 2025 21:29:11 +0000
Subject: [PATCH] Publish GHSA-cvx7-x8pj-x2gw

---
 .../GHSA-cvx7-x8pj-x2gw.json                  | 77 +++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/06/GHSA-cvx7-x8pj-x2gw/GHSA-cvx7-x8pj-x2gw.json

diff --git a/advisories/github-reviewed/2025/06/GHSA-cvx7-x8pj-x2gw/GHSA-cvx7-x8pj-x2gw.json b/advisories/github-reviewed/2025/06/GHSA-cvx7-x8pj-x2gw/GHSA-cvx7-x8pj-x2gw.json
new file mode 100644
index 00000000000..629f7dfc5d2
--- /dev/null
+++ b/advisories/github-reviewed/2025/06/GHSA-cvx7-x8pj-x2gw/GHSA-cvx7-x8pj-x2gw.json
@@ -0,0 +1,77 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cvx7-x8pj-x2gw",
+  "modified": "2025-06-06T21:27:28Z",
+  "published": "2025-06-06T21:27:27Z",
+  "aliases": [
+    "CVE-2025-47950"
+  ],
+  "summary": "CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification",
+  "details": "### Summary\n\nA **Denial of Service (DoS)** vulnerability was discovered in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments.\n\n### Impact\n\n- **Component**: `server_quic.go`\n- **Attack Vector**: Remote, network-based\n- **Attack Complexity**: Low\n- **Privileges Required**: None\n- **User Interaction**: None\n- **Impact**: High availability loss (OOM kill or unresponsiveness)\n\nThis issue affects deployments with `quic://` enabled in the Corefile. A single attacker can cause the CoreDNS instance to become unresponsive using minimal bandwidth and CPU.\n\n### Patches\n\nThe patch introduces two key mitigation mechanisms:\n\n- **`max_streams`**: Caps the number of concurrent QUIC streams per connection. Default: `256`.\n- **`worker_pool_size`**: Introduces a server-wide, bounded worker pool to process incoming streams. Default: `1024`.\n\nThis eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. The new configuration options are exposed through the `quic` Corefile block:\n\n```\nquic {\n    max_streams 256\n    worker_pool_size 1024\n}\n```\n\nThese defaults are generous and aligned with typical DNS-over-QUIC client behavior.\n\n### Workarounds\n\nIf you're unable to upgrade immediately, you can:\n- Disable QUIC support by removing or commenting out the `quic://` block in your Corefile\n- Use container runtime resource limits to detect and isolate excessive memory usage\n- Monitor QUIC connection patterns and alert on anomalies\n\n### References\n\n- [RFC 9250 - DNS over Dedicated QUIC Connections](https://datatracker.ietf.org/doc/html/rfc9250)\n- [quic-go GitHub project](https://github.com/quic-go/quic-go)\n- [QUIC stream exhaustion class of vulnerabilities (related)](https://www.usenix.org/conference/usenixsecurity23/presentation/botella)\n\n### Credit\n\nThanks to [@thevilledev](https://github.com/thevilledev) for disclovering this vulnerability and contributing a high-quality fix.\n\n### For more information\n\nPlease consult our [security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/coredns/coredns"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.21.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/coredns/coredns/security/advisories/GHSA-cvx7-x8pj-x2gw"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47950"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/coredns/coredns/commit/efaed02c6a480ec147b1f799aab7cf815b17dfe1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://datatracker.ietf.org/doc/html/rfc9250"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/coredns/coredns"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/quic-go/quic-go"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.usenix.org/conference/usenixsecurity23/presentation/botella"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-06-06T21:27:27Z",
+    "nvd_published_at": "2025-06-06T18:15:35Z"
+  }
+}
\ No newline at end of file