CVE-2025-47950

What it actually does

The CoreDNS DNS-over-QUIC server spawns an unbounded goroutine per incoming stream with no concurrency limits, causing uncontrolled memory growth that leads to OOM crashes.

Why it matters to the business

Produces DNS service outages, especially in containerized or memory-constrained environments, resulting in application downtime and operational disruption across dependent systems.

How an attack unfolds

A remote unauthenticated attacker opens a large number of QUIC streams against the DoQ listener, exhausting memory until the process crashes; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade ruby2.7 on Ubuntu 20.04 LTS to 2.7.0-5ubuntu1.12 and ruby2.3 on Ubuntu 16.04 Pro to 2.3.1-2~ubuntu16.04.16+esm8; apply the updates and restart affected services.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases and verify that stream or goroutine limits are now enforced under load testing.

Typical attack path

1. Connect to the exposed DNS-over-QUIC endpoint
2. Rapidly open thousands of concurrent streams
3. Continue stream creation until memory exhaustion triggers OOM kill or crash

How to detect it

Review CoreDNS logs for sudden spikes in QUIC stream counts or goroutine creation, and monitor system logs for OOM killer events targeting the DNS process.

What your security team should do

• Apply the published package updates without delay given the 507 days since disclosure
• Restrict exposure of DoQ ports to trusted clients only
• Implement container memory limits and monitoring to contain future DoS effects