GO-2026-6507 CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns

CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns...

CVE-2026-82399 CoreDNS: Unauthenticated memory exhaustion in custom transports

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack on attacker-controlled DNS section counts before...

CVE-2026-82399

CoreDNS versions prior to 1.14.7 are vulnerable to unauthenticated memory exhaustion via the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths. The root cause is that dns.Msg.Unpack is called on attacker-controlled DNS section counts before dns.DefaultMsgAcceptFunc v...

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

Summary When an application configures hubuumclient with ClientBuilder::withtransport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-outp...

GHSA-QQC3-94QV-7FW3 Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

Summary When an application configures hubuumclient with ClientBuilder::withtransport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-outp...