CVE-2025-58063

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58063", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-22T14:30:32.222Z", "datePublished": "2025-09-09T19:27:18.124Z", "dateUpdated": "2025-09-10T14:26:13.850Z"}, "containers": {"cna": {"title": "CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion", "problemTypes": [{"descriptions": [{"cweId": "CWE-681", "lang": "en", "description": "CWE-681: Incorrect Conversion between Numeric Types", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9"}, {"name": "https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf", "tags": ["x_refsource_MISC"], "url": "https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf"}], "affected": [{"vendor": "coredns", "product": "coredns", "versions": [{"version": ">= 1.2.0, < 1.12.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-09T19:27:18.124Z"}, "descriptions": [{"lang": "en", "value": "CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue."}], "source": {"advisory": "GHSA-93mf-426m-g6x9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-10T14:26:10.971285Z", "id": "CVE-2025-58063", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T14:26:13.850Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58063", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-10T14:26:10.971285Z"}}}], "references": [{"url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-10T14:26:02.976Z"}}], "cna": {"title": "CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion", "source": {"advisory": "GHSA-93mf-426m-g6x9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "coredns", "product": "coredns", "versions": [{"status": "affected", "version": ">= 1.2.0, < 1.12.4"}]}], "references": [{"url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9", "name": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf", "name": "https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-681", "description": "CWE-681: Incorrect Conversion between Numeric Types"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-09T19:27:18.124Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58063", "state": "PUBLISHED", "dateUpdated": "2025-09-10T14:26:13.850Z", "dateReserved": "2025-08-22T14:30:32.222Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-09T19:27:18.124Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "coredns", "vendor": "coredns", "versions": [{"status": "affected", "version": ">= 1.2.0, < 1.12.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue."}, {"lang": "es", "value": "CoreDNS es un servidor DNS que encadena plugins. A partir de la versi\u00f3n 1.2.0 y anterior a la versi\u00f3n 1.12.4, el plugin etcd de CoreDNS contiene una vulnerabilidad de confusi\u00f3n de TTL donde los IDs de arrendamiento se utilizan incorrectamente como valores TTL, lo que permite ataques de fijaci\u00f3n de cach\u00e9 DNS. Esto crea efectivamente una condici\u00f3n de DoS para la resoluci\u00f3n DNS de los servicios afectados. La funci\u00f3n 'TTL()' en 'plugin/etcd/etcd.go' convierte incorrectamente los IDs de arrendamiento de etcd (enteros de 64 bits) a uint32 y los utiliza como valores TTL. Los IDs de arrendamiento grandes se convierten en TTLs muy grandes cuando se convierten a uint32. Esto permite ataques de fijaci\u00f3n de cach\u00e9. La versi\u00f3n 1.12.4 contiene una soluci\u00f3n para el problema."}], "id": "CVE-2025-58063", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58063", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-10T14:26:10.971285Z", "version": "2.0.3"}}]}, "published": "2025-09-09T20:15:48.057", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf"}, {"source": "security-advisories@github.com", "url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-681"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/coredns/coredns: CoreDNS Lease ID Confusion", "id": "2394215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394215"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-681", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-58063", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/lighthouse-agent-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/lighthouse-coredns-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/lighthouse-coredns-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift4/ose-coredns-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-09-09T19:27:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-58063\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-58063\nhttps://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf\nhttps://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9"], "threat_severity": "Moderate"}

{"created": "2025-09-12T09:11:48.692474+00:00", "updated": "2025-09-12T09:11:48.692527+00:00", "vendors": ["coredns.io", "coredns.io$PRODUCT$coredns"]}