OESA-2026-3065 coredns security update

🗓️ 19 Jul 2026 11:11:57Reported by GoogleType

osv🔗 osv.dev👁 6 Views

CoreDNS pre-1.14.2 has TOCTOU flaw letting attackers bypass ACL security controls via plugin ordering.

Reporter	Title	Published	Views	Family All 221
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	22 Jun 202614:33	–	ibm
attackerkb	CVE-2026-26017	6 Mar 202615:36	–	attackerkb
AlpineLinux	CVE-2025-68151	8 Jan 202615:33	–	alpinelinux
AlpineLinux	CVE-2026-26017	6 Mar 202615:36	–	alpinelinux
BDU FSTEC	The vulnerability of the Coredns DNS server, related to unlimited resource distribution, allows attackers to cause service failures.	25 Mar 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Coredns DNS server, related to synchronization errors when using a shared resource, allows attackers to increase their privileges.	21 Aug 202600:00	–	bdu_fstec
CBLMariner	CVE-2025-68151 affecting package coredns for versions less than 1.11.4-13	9 Feb 202623:37	–	cbl_mariner
CBLMariner	CVE-2025-68151 affecting package coredns for versions less than 1.11.1-25	5 Feb 202622:21	–	cbl_mariner
CBLMariner	CVE-2026-26017 affecting package coredns for versions less than 1.11.4-15	13 Mar 202619:01	–	cbl_mariner
CBLMariner	CVE-2026-26017 affecting package coredns for versions less than 1.11.1-26	13 Mar 202617:35	–	cbl_mariner

Source	Link
openeuler	www.openeuler.org/zh/security/security-bulletins/detail/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-68151
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-26017

18 Aug 2026 01:21Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.00483

CoreDNS DoS TOCTOU ACL bypass gRPC HTTP/3 CVE-2026-26017