CVE-2022-2837: coredns.io coredns
Vulnerability summary
CVE-2022-2837 is a medium (CVSS 6.1) vulnerability in coredns.io coredns. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.9% of scored vulnerabilities.
Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 8Timeline
- 03-03-2023PublishedVulnerability first disclosed.
- 07-03-2025Last modifiedVulnerability information updated.
Description
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · GoEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.39% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-923Improper Restriction of Communication Channel to Intended EndpointsThe product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
- CWE-601URL Redirection to Untrusted SiteThe web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard4 products
- juicefs-1.2< 1.2.4-r1
- juicefs-1.2-compat< 1.2.4-r1
- juicefs-1.3< 1.3.0-r2
- juicefs-1.3-compat< 1.3.0-r2
Wolfi2 products
- juicefs-1.3< 1.3.0-r2
- juicefs-1.3-compat< 1.3.0-r2
Coredns.io1 product
- corednsna
Github.com/coredns1 product
- coredns≤ 1.9.3
4 vendors · 8 products
References
3 links
- github.com/coredns/corednsPACKAGE