CLEANSTART-2026-MG32349 CoreDNS is a DNS server written in Go

Security vulnerability affects the kubernetes-dns-node-cache package. CoreDNS is a DNS server written in Go...

CLEANSTART-2026-GT82113 CoreDNS is a DNS server written in Go

Security vulnerability affects the kubernetes-dns-node-cache package. CoreDNS is a DNS server written in Go...

cve-test-coredns-fork

This repository does not have a README...

CLEANSTART-2026-EH67735 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Security vulnerability affects the coredns-fips package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...

OPENSUSE-SU-2026:12209-1 coredns-1.15.0-1.1 on GA media

These are all security issues fixed in the coredns-1.15.0-1.1 package on the GA media of openSUSE Tumbleweed...

Security update for coredns (important)

openSUSE security update: security update for coredns ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22135-1 Rating: important References: bsc1279216 Cross-References: CVE-2026-84304 CVSS scores: CVE-2026-84304 SUSE : 7.5...

OPENSUSE-SU-2026:22135-1 Security update for coredns

This update for coredns fixes the following issues: Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport boo1279216 Done through the gomodules "require" parameter in servi...

GHSA-74W3-63XV-X9MV CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8sexternal transferer can emit an empty...

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8sexternal transferer can emit an empty...

OPENSUSE-SU-2026:12149-1 coredns-1.14.7-3.1 on GA media

These are all security issues fixed in the coredns-1.14.7-3.1 package on the GA media of openSUSE Tumbleweed...

AZL-107279 CVE-2026-97032 affecting package coredns 1.11.4-21

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107273 CVE-2026-78669 affecting package coredns 1.11.4-21

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107267 CVE-2026-78660 affecting package coredns 1.11.4-21

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107270 CVE-2026-78659 affecting package coredns 1.11.4-21

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107276 CVE-2026-78663 affecting package coredns 1.11.4-21

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-82399 affecting package coredns for versions less than 1.11.4-22

CVE-2026-82399 affecting package coredns for versions less than 1.11.4-22. A patched version of the package is available...

CVE-2026-86003 affecting package coredns for versions less than 1.11.4-22

CVE-2026-86003 affecting package coredns for versions less than 1.11.4-22. A patched version of the package is available...

CLEANSTART-2026-DD22310 During the TLS 1

Security vulnerability affects the coredns package. During the TLS 1...

CLEANSTART-2026-TP40136 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

Security vulnerability affects the coredns package. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content...

CLEANSTART-2026-ZQ25386 Downloading and building modules with malicious version strings can cause local code execution

Security vulnerability affects the coredns package. Downloading and building modules with malicious version strings can cause local code execution...