NRDAX-T0332 - Unbounded Stream Resource Exhaustion

mechanism

CoreDNS DoQ stream slowloris (CVE-2025-47950 / GHSA-cvx7-x8pj-x2gw): CoreDNS' DNS-over-QUIC server created a new goroutine for every incoming QUIC stream with NO cap on concurrent streams/goroutines (1:1 stream->goroutine). The DoQ framing (RFC 9250: 2-octet big-endian length prefix per DNS message) reads that prefix and the body with blocking io.ReadFull() calls that have NO per-stream read deadline. A remote, unauthenticated attacker opens many QUIC streams (e.g. 60 conns x 256 streams = 15,360) and sends only 1 byte on each - the first byte of the length prefix - then stalls; each io.ReadFull blocks forever waiting for the second byte, pinning a worker goroutine, and once workers are exhausted every further stream still spawns a goroutine that blocks on a worker token, so goroutine/RSS grow without bound -> OOM-kill/crash (a QUIC-native slowloris), especially in memory-constrained containers. CVSS 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affects `quic://`-enabled Corefiles; no workaround; fixed v1.12.2 (max_streams default 256 + bounded worker_pool_size default 1024). Fix was incomplete - regression CVE-2026-32934 / GHSA-2wpx-qpw2-g5h5, fixed v1.14.3. PUBLIC-CVE REPLICATION - wire signature only (loopback UDP mock, no CoreDNS DoQ server stood up).

instances (1)

references

cite

https://nrdax.com/techniques/NRDAX-T0332

@misc{nrdax_NRDAX_T0332,
  title = {Unbounded Stream Resource Exhaustion (NRDAX-T0332)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0332},
}

{
  "id": "nrdax-NRDAX-T0332",
  "type": "dataset",
  "title": "Unbounded Stream Resource Exhaustion (NRDAX-T0332)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0332",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0332 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0332.svg)](https://nrdax.com/techniques/NRDAX-T0332-unbounded-stream-resource-exhaustion)