CVE-2025-58063: CoreDNS Vulnerability Could Disrupt DNS Updates

CVE-2025-58063 concerns a CoreDNS vulnerability in the etcd plugin that could allow cache pinning and denial of DNS updates. The flaw is described as a TTL confusion vulnerability, where lease IDs are incorrectly used as TTL values, enabling cache entries to be pinned for very long periods. In affected versions, etcd lease IDs are cast into TTLs, with large lease IDs potentially producing TTLs that cause downstream resolvers and clients to cache answers for years.

An attacker would need etcd write access, which could arise from compromised service accounts, misconfigured RBAC/TLS, exposed etcd instances, or insider threats, enabling them to write or update a key with an arbitrary lease and have CoreDNS serve a DNS record with an inflated TTL. The advisory notes that even after the key is deleted or CoreDNS is restarted, cached responses can persist until caches expire, and some resolvers’ TTL caps may be insufficient to predict the impact.

Administrators are urged to update to patched releases (v1.12.4) and review access policies to restrict etcd writes, per CoreDNS security advisories GHSA-93mf-426m-g6x9. September 11, 2025. according to CoreDNS security advisories GHSA-93mf-426m-g6x9