CVE-2025-58063

What it actually does

The TTL() function in plugin/etcd/etcd.go casts etcd lease IDs (64-bit integers) to uint32 and treats the resulting values as DNS TTLs; large lease IDs produce extremely large TTLs that pin cache entries and prevent refresh or replacement of affected DNS records.

Why it matters to the business

Organizations running CoreDNS with the etcd plugin risk prolonged DNS resolution failures for services that rely on dynamic etcd-backed records, causing application outages and operational disruption until the affected instances are upgraded.

How an attack unfolds

An attacker with the ability to influence etcd lease creation supplies leases whose IDs exceed 32 bits; CoreDNS incorrectly interprets those IDs as TTL values, resulting in cache entries that remain valid for an impractically long time and block legitimate record updates or failover.

How to fix it

Upgrade coredns/coredns to the fixed commit f32329577fd5e3fe19908f8a9ba5c76aafb45bf6 (version 1.12.4) or later; rebuild and redeploy all affected CoreDNS instances; verify that the etcd plugin no longer casts lease IDs to uint32 for TTL calculations.

How to confirm the fix worked

Confirm the running binary reports version 1.12.4 or newer; inspect plugin/etcd/etcd.go for the corrected TTL handling; perform controlled lease creation followed by DNS queries and verify that returned TTL values remain within expected bounds.

Typical attack path

1. Obtain write access to the etcd cluster used by CoreDNS
2. Create or renew leases that generate large 64-bit lease IDs
3. Trigger DNS queries against CoreDNS instances using the etcd plugin
4. Observe that the resulting cache entries receive excessively large TTLs and cannot be refreshed

How to detect it

Search CoreDNS request and cache logs for TTL values exceeding normal service lifetimes; correlate with etcd lease events that produce unusually large lease IDs; review audit logs for unexpected lease creation activity around the time of observed resolution failures.

What your security team should do

• Immediately schedule upgrade of all CoreDNS deployments using the etcd plugin to version 1.12.4
• Add CoreDNS version checks to continuous compliance scanning
• Review etcd access controls to limit lease creation privileges to trusted components only
• Monitor DNS cache hit rates and TTL distributions for anomalies until all instances are updated