Introduction
One mistake in DNS cache management can cause long outages for critical services. In Kubernetes and other cloud-native environments, CoreDNS handles service discovery and DNS resolution. CVE-2025-58063 is a flaw in the CoreDNS etcd plugin that lets attackers pin DNS cache entries for abnormally long periods, which denies service to legitimate queries.
About CoreDNS and etcd: CoreDNS is a widely used DNS server and the default DNS provider in Kubernetes clusters. Its plugin-based architecture allows integration with etcd, a distributed key-value store used for service discovery and configuration. Both are core parts of container orchestration and cloud-native infrastructure, and thousands of organizations around the world depend on them.
Technical Information
CVE-2025-58063 comes from how the CoreDNS etcd plugin interacts with etcd's lease management system. The bug is in the TTL() function in plugin/etcd/etcd.go. That function retrieves lease information from etcd, mistakenly casts the 64-bit lease ID (int64) to a 32-bit unsigned integer (uint32), and uses the result as the DNS TTL (time to live) for responses.
Because of this type confusion (CWE-681), a large lease ID can produce an extremely high TTL, and DNS records may then be cached for years. Attackers with access to etcd can deliberately create or use large lease IDs, so CoreDNS returns DNS responses with excessive TTL values. Downstream DNS resolvers and clients honor these TTLs. Malicious or stale records stay pinned in their caches, and legitimate DNS resolution for the affected names fails.
The vulnerability is present only when the etcd plugin is enabled and used for DNS record management. The root cause is that the plugin uses the lease ID as the TTL instead of retrieving the actual TTL value associated with the lease.
References for technical details:
- CWE-681: Incorrect Conversion between Numeric Types
- CoreDNS etcd plugin documentation
- CoreDNS 1.2.0 release notes (etcd v3 support)
Affected Systems and Versions
- CoreDNS versions 1.2.0 up to but not including 1.12.4
- Only deployments with the etcd plugin enabled are vulnerable
- The vulnerable code is in the plugin/etcd/etcd.go file
Vendor Security History
CoreDNS has a strong security track record. A third-party security audit in 2018 found several DoS and information disclosure issues, and the project fixed them. CoreDNS is a CNCF graduate and is widely adopted in Kubernetes. The project has patched previous vulnerabilities in a timely way. The etcd plugin has changed over time, and CoreDNS 1.2.0 introduced v3 support.
