CVE-2024-0874

mediumpriority · track · 0EPSS 0.008 · 55 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.76% (55th) EPSS

CVSS 5.3 · medium

Is it mine?

44 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · secalert@redhat.com USexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-524USCWE-524USCWE-524US

affected products (44)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Ansible Automation Platformall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
Red Hat OpenShift <4.16.24all versionscert_bundDE
Red Hat OpenShift API for Data Protection 1all versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection_1
Red Hat OpenShift Container Platform <4.12.63all versionscert_bundDE
Red Hat OpenShift Container Platform <4.14.38all versionscert_bundDE
Red Hat OpenShift Container Platform <4.15.28all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.0all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.1all versionscert_bundDE
Red Hat OpenShift Container Platform <4.16.23all versionscert_bundDE
Red Hat OpenShift Container Platform <4.18.10all versionscert_bundDE
Red Hat OpenShift Kube Descheduler Operator 5all versionscert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
Red Hat OpenShift Run Once Duration Override Operator 1all versionscert_bundDEcpe:/a:redhat:openshift:run_once_duration_override_operator_1
Red Hat OpenShift Secondary Scheduler Operatorall versionscert_bundDEcpe:/a:redhat:openshift:::secondary_scheduler_operator
Red Hat OpenShift Virtualization <4.15.5all versionscert_bundDE

showing 20 of 44

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1030CoreDNS: Schwachstelle ermöglicht Manipulation von DatenDeutsch2024-05-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in CoreDNS ausnutzen, um Daten zu manipulieren.
WID-SEC-W-2024-1474Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-06-27csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
GHSA-m9w6-wp3h-vq8g CoreDNS may return invalid cache entries2024-04-25ghsa · osvUS
A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.
GO-2024-2785CoreDNS may return invalid cache entries in github.com/coredns/coredns2024-06-04vendor · osvUS
A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

published 2024-04-25modified 2026-10-13

references (21)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan