CVE-2025-58063

Aliases:GHSA-93mf-426m-g6x9GO-2025-3942CGA-29g8-pr2r-9hvrCGA-3j73-w8w9-7p5mCGA-42q7-cvxh-xh38CGA-7g7g-m294-vc2vCGA-j7jv-gcm3-37hgCGA-2rf3-q256-r5xvCGA-3gw7-wrcm-87q9CGA-3wph-g4v6-wwqxCGA-4278-3v3h-p2c4CGA-4mmf-jmv2-4jr9CGA-4rv2-mm62-w7j6CGA-5f85-ph8v-xgxwCGA-76x7-72q8-pxr3CGA-7pcq-q9m6-c7mmCGA-8vpq-f3x5-qcq3CGA-c6xh-qj7f-jxxwCGA-cvj7-x98h-2v46CGA-cwjp-fr37-5g5qCGA-fgvm-97f6-qcvfCGA-gg5f-vc8p-w8rqCGA-gxpf-p9f8-4xj3CGA-h4fj-45fv-jhp5CGA-jgf2-9pxr-fr7mCGA-jp3g-fh9f-3xq4CGA-jq69-vcx7-v24xCGA-jw8m-29wx-6vxcCGA-m6rv-8rf2-6x29CGA-mh3p-7f9r-w583CGA-mvwh-wmgh-8mr2CGA-pjf5-62c3-6g4pCGA-pvpx-xjjv-9pjxCGA-q5x8-677x-9cf8CGA-qqw6-7q54-jf84CGA-rh7g-rpm7-f4mfCGA-v85h-7hxp-r9wwCGA-vjmg-h64q-q848CGA-vp3f-77w2-86rvCGA-vxcj-mp3g-6g87CGA-w75g-hgm3-p893CGA-wm49-m8mw-qwr8CGA-wmj6-4868-99f4CGA-wpmh-rr3j-pj3qCGA-wpph-39gj-cx2cCGA-x6j4-wc9r-jvwj
Advisory lineage Upstream: 0 Downstream: 5
Deferred
Published: 09 Sept 2025, 19:27
Last modified:10 Sept 2025, 14:26

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7.1 HIGH
v3.1 (cve.org)
EPSS Score
0.4% LOW
0% probability +0.33%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Sept 2025, 19:27
Published
Vulnerability first disclosed
10 Sept 2025, 14:26
Last Modified
Vulnerability information updated

Description

CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of affected services. The `TTL()` function in `plugin/etcd/etcd.go` incorrectly casts etcd lease IDs (64-bit integers) to uint32 and uses them as TTL values. Large lease IDs become very large TTLs when cast to uint32. This enables cache pinning attacks. Version 1.12.4 contains a fix for the issue.

CVSS Metrics

  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS Trends

Current EPSS score: 0.40%• Percentile: 35%

Techniques & Countermeasures

  • CWE-681•Incorrect Conversion between Numeric Types

    When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Affected Systems

  • chainguard•cloudflared

    < 2026.2.0-r0

  • chainguard•cloudflared-fips

    < 2026.2.0-r0

  • chainguard•eks-distro-coredns-1.29

    < 1.29.53-r1

  • chainguard•eks-distro-coredns-1.30

    < 1.30.46-r1

  • chainguard•eks-distro-coredns-1.31

    < 1.31.35-r1

  • chainguard•eks-distro-coredns-1.32

    < 1.32.28-r1

  • chainguard•eks-distro-coredns-1.33

    < 1.33.18-r0 | < 1.33.18-r1

  • chainguard•eks-distro-coredns-1.34

    < 1.34.9-r1

  • chainguard•eks-distro-coredns-fips-1.29

    < 1.29.53-r1

  • chainguard•eks-distro-coredns-fips-1.30

    < 1.30.46-r1

  • chainguard•eks-distro-coredns-fips-1.31

    < 1.31.35-r1

  • chainguard•eks-distro-coredns-fips-1.32

    < 1.32.28-r1

  • chainguard•eks-distro-coredns-fips-1.33

    < 1.33.18-r1

  • chainguard•eks-distro-coredns-fips-1.34

    < 1.34.9-r1 | < 1.34.9-r0

  • chainguard•juicefs-1.2

    < 1.2.4-r4

  • chainguard•juicefs-1.2-compat

    < 1.2.4-r4

  • chainguard•juicefs-1.3

    < 1.3.0-r5

  • chainguard•juicefs-1.3-compat

    < 1.3.0-r5

  • chainguard•k8s_gateway

    < 1.6.1-r0

  • chainguard•k8s_gateway-fips

    < 1.6.1-r0

  • chainguard•kubernetes-dns-node-cache

    < 1.26.5-r1

  • chainguard•kubernetes-dns-node-cache-fips

    < 1.26.5-r1

  • wolfi•cloudflared

    < 2026.2.0-r0

  • wolfi•juicefs-1.3

    < 1.3.0-r5

  • wolfi•juicefs-1.3-compat

    < 1.3.0-r5

  • wolfi•k8s_gateway

    < 1.6.1-r0

  • wolfi•kubernetes-dns-node-cache

    < 1.26.5-r1

  • coredns•coredns

    ≥ 1.2.0, < 1.12.4

  • github.com/coredns•coredns

    ≥ 1.2.0, < 1.12.4

References (5)