CoreDNS Vulnerability Allows Attackers to Poison DNS Cache and Block Updates

CoreDNS has a vulnerability in its etcd plugin (CVE-2025-58063) that lets attackers pin DNS records in caches for years by miscasting a 64-bit lease ID as a 32-bit TTL. The flaw arises in the TTL() function of plugin/etcd/etcd[.]go and can cause extremely large TTL values, enabling downstream resolvers to cache records indefinitely. It affects every CoreDNS release from version 1.2.0 onward and was patched in version 1.12.4, according to Github.

An attacker with write access to etcd can attach any lease to a DNS record and cause CoreDNS to respond with bogus TTLs, effectively blocking legitimate updates or deletions until the lease expires. Administrators should upgrade to the patched version immediately or enforce TTL limits in DNS resolvers to clamp excessive values, and regularly audit etcd permissions and credentials to reduce the risk of unauthorized write access, as per the report.