https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:33:36 +0000 https://cve.radiocsirt.org/vuln/cve-2024-7598 <p><strong>Affected:</strong> Kubernetes kube-apiserver</p> <p>A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.</p> <p><strong>Affected:</strong> Kubernetes kube-apiserver</p> <p>A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.</p> https://cve.radiocsirt.org/vuln/cve-2024-7598 https://cve.radiocsirt.org/vuln/ghsa-2wpx-qpw2-g5h5 <p><strong>Affected:</strong> Go: github.com/coredns/coredns</p> <p>### Summary CoreDNS&#39; DNS-over-QUIC (DoQ) server can be driven into large goroutine and memory growth by a remote client that opens many QUIC streams and stalls after sending only 1 byte. Even with a small configured quic { worker_pool_size ... }, CoreDNS still spawns a goroutine per accepted stream (workers + waiters) and active workers can block indefinitely in io.ReadFull() with no per-stream read deadline, enabling unauthenticated remote DoS via memory exhaustion/OOM-kill.</p> <p>### Details CoreDNS&#39; DoQ server uses a global worker pool (streamProcessPool) to limit concurrent stream processing, but when the pool is full it still spawns a goroutine per accepted stream that waits to acquire a worker token: select { case s.streamProcessPool &lt;- ...: go ...; default: go ... wait for token ... } (core/dnsserver/server_quic.go)</p> <p>Additionally, the DoQ message framing reads are blocking io.ReadFull() calls with no per-stream read deadline: readDOQMessage() reads the 2-byte length prefix and message body via io.ReadFull() (core/dnsserver/server_quic.go)</p> <p>This allows an attacker to pin all workers by sending 1 byte (so io.ReadFull() blocks waiting for the second byte of the DoQ length prefix), while also creating an unbounded backlog of goroutines waiting for a worker token.</p> <p>Note: this appears to be a result of an incomplete fix/regression for CVE-2025-47950 (GHSA-cvx7-x8pj-x2gw).</p> <p>### PoC 1. Adjust COREDNS_BIN in the PoC to point at right path (see the top-level const definitions for tu…</p> <p><strong>Affected:</strong> Go: github.com/coredns/coredns</p> <p>### Summary CoreDNS&#39; DNS-over-QUIC (DoQ) server can be driven into large goroutine and memory growth by a remote client that opens many QUIC streams and stalls after sending only 1 byte. Even with a small configured quic { worker_pool_size ... }, CoreDNS still spawns a goroutine per accepted stream (workers + waiters) and active workers can block indefinitely in io.ReadFull() with no per-stream read deadline, enabling unauthenticated remote DoS via memory exhaustion/OOM-kill.</p> <p>### Details CoreDNS&#39; DoQ server uses a global worker pool (streamProcessPool) to limit concurrent stream processing, but when the pool is full it still spawns a goroutine per accepted stream that waits to acquire a worker token: select { case s.streamProcessPool &lt;- ...: go ...; default: go ... wait for token ... } (core/dnsserver/server_quic.go)</p> <p>Additionally, the DoQ message framing reads are blocking io.ReadFull() calls with no per-stream read deadline: readDOQMessage() reads the 2-byte length prefix and message body via io.ReadFull() (core/dnsserver/server_quic.go)</p> <p>This allows an attacker to pin all workers by sending 1 byte (so io.ReadFull() blocks waiting for the second byte of the DoQ length prefix), while also creating an unbounded backlog of goroutines waiting for a worker token.</p> <p>Note: this appears to be a result of an incomplete fix/regression for CVE-2025-47950 (GHSA-cvx7-x8pj-x2gw).</p> <p>### PoC 1. Adjust COREDNS_BIN in the PoC to point at right path (see the top-level const definitions for tu…</p> https://cve.radiocsirt.org/vuln/ghsa-2wpx-qpw2-g5h5