CVE-2026-82399

A flaw was found in CoreDNS. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted DNS requests over custom transports, such as DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC. By using DNS name compression and excessive section counts, t...

CVE-2026-86003

A flaw was found in CoreDNS. The DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners do not properly validate incoming DNS update requests. An unauthenticated client can send a specially crafted DNS update RFC 2136 UPDATE that CoreDNS forwards to an upstream DNS server. If...

CVE-2026-82399

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before...

CVE-2026-86003

CoreDNS (a DNS server written in Go) prior to 1.14.7 fails to enforce the dns.DefaultMsgAcceptFunc request policy on its DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners. Unlike the UDP, TCP, and DNS-over-TLS paths, these listeners call dns.Msg.Unpack without that polic...

CVE-2026-86003 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-82399

CoreDNS versions prior to 1.14.7 are vulnerable to unauthenticated memory exhaustion via the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths. The root cause is that dns.Msg.Unpack is called on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc v...

EUVD-2026-80987

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before...

cve-test-coredns-fork

This repository does not have a README...

CVE-2026-62994

A flaw was found in CoreDNS, a DNS server. A remote attacker can trigger a denial of service by sending a specially crafted AXFR request to a CoreDNS zone. This occurs when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint...

CVE-2026-62299

A flaw was found in CoreDNS, a DNS server. A remote, unauthenticated client can exploit this vulnerability by sending a specially crafted DNS query that triggers a null pointer dereference in the rewrite plugin's EDNS0 response handling. This can lead to a denial of service DoS where the CoreDNS...

CVE-2026-62309

A flaw was found in CoreDNS. A remote attacker can send a specially crafted 28-byte UDP datagram to a CoreDNS server with the proxyproto plugin enabled. This malformed datagram can cause the CoreDNS process to crash, leading to a denial of service DoS. The vulnerability arises from improper...

openSUSE 16 Security Update : coredns (openSUSE-SU-2026:21674-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21674-1 advisory. Changes in coredns: - Update to version 1.14.7: plugin/acl, plugin/cache, plugin/file, plugin/forward, plugin/kubernetes: assorted correctness fixes...

Security update for coredns (moderate)

openSUSE security update: security update for coredns ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21674-1 Rating: moderate References: bsc1276712 Cross-References: CVE-2026-41178 CVSS scores: CVE-2026-41178 SUSE : 5.3...

OPENSUSE-SU-2026:21674-1 Security update for coredns

This update for coredns fixes the following issues: Changes in coredns: - Update to version 1.14.7: plugin/acl, plugin/cache, plugin/file, plugin/forward, plugin/kubernetes: assorted correctness fixes stale-cache races, AXFR zone contamination, DoH health-check TLS config, failover counter reset,...

OPENSUSE-SU-2026:11608-1 coredns-1.14.7-1.1 on GA media

These are all security issues fixed in the coredns-1.14.7-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: coredns, rke2-runtime, dkron, kubo-fips, ipfs-cluster-fips, k8sgateway-fips, eks-distro, caddy-fips, kargo, seaweedfs-fips, frp, traefik-fips, buf, syncthing, spegel, spegel-fips, k8sgateway, kubernetes-dns-node-cache-fips, ipfs-cluster, syncthing-fips,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: azurefile-csi-fips, coredns, rke2-runtime, aws-sigv4-proxy-fips, jaeger-fips, opentofu, atlantis, dgraph, loki-fips, net-kourier-fips, cadvisor, blobfuse2, karpenter, prometheus-snmp-exporter, cloud-provider-azure-fips, aws-flb-firehose-fips,...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: gomplate, dgraph, loki-fips, dagdotdev, kyverno-policy-reporter-plugins-kyverno-fips, datadog-agent-fips, containerd, keda, kong-ingress-controller, harbor, terragrunt, aws-otel-collector-fips, cloud-provider-vsphere, k8s-agents-operator, rke2-cloud-provider,...

GO-2026-4868 vulnerabilities

Vulnerabilities for packages: azurefile-csi-fips, coredns, rke2-runtime, aws-sigv4-proxy-fips, jaeger-fips, opentofu, atlantis, dgraph, loki-fips, net-kourier-fips, cadvisor, blobfuse2, karpenter, prometheus-snmp-exporter, cloud-provider-azure-fips, aws-flb-firehose-fips,...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: gomplate, external-dns, pulumi, dex, cluster-api-aws-controller, loki-fips, net-kourier-fips, cinder-csi-plugin-fips, fleet-server, karpenter, kubernetes-dashboard-fips, tofu-controller, kyverno-policy-reporter-plugins-kyverno-fips, prometheus-pushgateway-fips,...