ioc2rpz

ioc2rpz™ makes your threat intelligence actionable Table of Contents Short Summary Overview ioc2rpz™ is a place where threat intelligence meets DNS Architecture Overview How to use ioc2rpz™ ioc2rpz™ web interface Protocol Support Port Summary UDP Port 53 TCP Port 53 DNS over TLS / DoT Port 853 DN...

DoH_c2_Trigger

DoHc2Trigger Code for blogpost: https://outflank.nl/blog/2018/10/25/building-resilient-c2-infrastructues-using-dns-over-https/...

dark-doh

dark-doh.exe public version Purpose: Download files via DoH, or download and execute a shellcode not implemented in the public version Run example: dark-doh.exe file1 download google yourdomain.com The supporting python script for DNS zone generation added py-prepzones.py. !!! Disclaimer !!! The...

gha-lab-6904b2ccbe

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of serverless-dns/serverless-dns at commi...

dns-benchmark-tool

⚠️ this project has moved and is no longer maintained. install the successor: pip install net-benchmark repository: https://github.com/net-benchmark/net-benchmark all existing commands and flags remain fully compatible. DNS Benchmark Tool Part of BuildTools - Network Performance Suite Fast,...

GO-2026-6506 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns...

Security update for coredns (important)

openSUSE Security Update: Security update for coredns Announcement ID: openSUSE-SU-2026:0324-1 Rating: important References: 1276712 Cross-References: CVE-2026-27140 CVE-2026-27143 CVE-2026-27144 CVE-2026-32282 CVE-2026-32283 CVE-2026-32288 CVE-2026-32289 CVE-2026-32934 CVE-2026-32936...

Updated bind package fixes security vulnerabilities

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification CVE-2026-19033. qpcache NOQNAME proof use-after-free crashes recursive resolver CVE-2026-19662. Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path CVE-2026-19666. Remote assertion failure via 16-bit...

The vulnerability of the dns.Msg.Unpack() function in the plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go files of the coredns server allows a attacker to compromise the integrity of the protected information.

The vulnerability of the dns.Msg.Unpack function in the plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go files of the coredns server is related to the ability to bypass access control mechanisms. Exploiting this vulnerability allows a malicious actor to...

GHSA-9GM5-9RFH-M6VX CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...

EUVD-2026-80989

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP...

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...

unbound: Unbound: Denial of Service via use-after-free in DoH stream cleanup

A use-after-free vulnerability in Unbound's DNS-over-HTTPS DoH stream cleanup code allows a remote attacker to cause a denial of service DoS. When DoH support is compiled, sending a specially crafted DoH connection under specific failure conditions—such as an RPZ drop query or heavy traffic—cause...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: coredns (UTSA-2026-109796)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109796 advisory. CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. F...

CVE-2026-86003

CoreDNS (a DNS server written in Go) prior to 1.14.7 fails to enforce the dns.DefaultMsgAcceptFunc request policy on its DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners. Unlike the UDP, TCP, and DNS-over-TLS paths, these listeners call dns.Msg.Unpack without that polic...

CVE-2026-86003 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-86003 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-82399 CoreDNS: Unauthenticated memory exhaustion in custom transports

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before...

CVE-2026-77692 Unauthenticated remote crash of named via a single DoH SIG(0) request

An attacker can cause named to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG0 record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1...

CVE-2026-77692

CVE-2026-77692 allows an unauthenticated remote attacker to crash the BIND 9 named daemon by sending a single crafted DNS-over-HTTPS (DoH) request containing a cryptographically invalid SIG(0) record and then closing the transport connection prematurely . The resulting abort produces an availabil...