Vulnerabilities

Filters

1 selected

19 records

Sort

Vendor: coredns Clear all filters

TI-2026-58862 CVE-2026-86003 · GHSA-9gm5-9rfh-m6vx

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

LOW 39

CoreDNS is a DNS server written in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00436 Published 2026-09-16 Partial fix · 1.14.7 CWE-441

TI-2026-56816 CVE-2026-82399 · GHSA-mrg3-qvqr-jw29

CoreDNS: Unauthenticated memory exhaustion in custom transports

HIGH 72

CoreDNS is a DNS server written in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-09-16 Partial fix · 1.14.7 CWE-770

TI-2026-44486 CVE-2026-62299

NULL pointer dereference in coredns

MEDIUM 63

CoreDNS is a DNS server written in Go.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00538 Published 2026-07-16 Partial fix · 1.14.5 CWE-476

TI-2026-44488 CVE-2026-62309

CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS

MEDIUM 40

CoreDNS is a DNS server written in Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00662 Published 2026-07-16 Partial fix · 1.14.4 CWE-476

TI-2026-44995 CVE-2026-62994 · GHSA-74w3-63xv-x9mv

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

MEDIUM 51

CoreDNS is a DNS server written in Go.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00459 Published 2026-07-16 Partial fix · 1.14.5 CWE-248

TI-2026-27682 CVE-2026-35579 · GHSA-vp29-5652-4fw9

CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports

HIGH 75

CoreDNS is a DNS server written in Go.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00611 Published 2026-05-05 Fixed in 1.14.3 CWE-287

TI-2026-25885 CVE-2026-33489 · GHSA-h8mm-c463-wjq3

CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

HIGH 75

CoreDNS is a DNS server that chains plugins.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00404 Published 2026-05-05 Partial fix · 1.14.3 CWE-863

TI-2026-25384 CVE-2026-32936 · GHSA-63cw-r7xf-jmwr

CoreDNS DoH GET path missing size validation causes CPU and memory amplification

HIGH 77

CoreDNS is a DNS server that chains plugins.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00672 Published 2026-05-05 Fixed in 1.14.3 CWE-400

TI-2026-25382 CVE-2026-32934 · GHSA-2wpx-qpw2-g5h5

CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service

HIGH 77

CoreDNS is a DNS server that chains plugins.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00469 Published 2026-05-05 Partial fix · 1.14.3 CWE-770

TI-2026-25615 CVE-2026-33190 · GHSA-qhmp-q7xh-99rh

CoreDNS TSIG authentication bypass on encrypted DNS transports

HIGH 77

CoreDNS is a DNS server that chains plugins.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00374 Published 2026-05-05 Partial fix · 1.14.3 CWE-303

TI-2026-21031 CVE-2026-26017 · GHSA-c9v3-4pv7-87pr

CoreDNS ACL Bypass

LOW 34

CoreDNS is a DNS server that chains plugins.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0042 Published 2026-03-06 Partial fix · 1.14.2 CWE-367

TI-2026-21032 CVE-2026-26018 · GHSA-h75p-j8xm-m278

CoreDNS Loop Detection Denial of Service Vulnerability

MEDIUM 41

CoreDNS is a DNS server that chains plugins.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01241 Published 2026-03-06 Partial fix · 1.14.2 CWE-337

TI-2025-41731 CVE-2025-68151 · GHSA-527x-5wrf-22m2

CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages

LOW 36

CoreDNS is a DNS server that chains plugins.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00494 Published 2026-01-08 Partial fix · 1.14.0 CWE-770

TI-2025-35906 CVE-2025-58063 · GHSA-93mf-426m-g6x9

CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion

MEDIUM 64

CoreDNS is a DNS server that chains plugins.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00506 Published 2025-09-09 Partial fix · 1.12.4 CWE-681

TI-2025-30343 CVE-2025-47950 · GHSA-cvx7-x8pj-x2gw

CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification

MEDIUM 41

CoreDNS is a DNS server that chains plugins.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01194 Published 2025-06-06 Fixed in 1.12.2 CWE-770

TI-2023-14301 CVE-2023-30464 · GHSA-h92q-fgpp-qhrq

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.

LOW 39

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00408 Published 2024-09-18 No fix listed CWE-290

TI-2023-12995 CVE-2023-28452 · GHSA-hfmw-7g3m-gj6q

An issue was discovered in CoreDNS through 1.10.1.

LOW 34

An issue was discovered in CoreDNS through 1.10.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00613 Published 2024-09-18 Fixed in 1.11.0 CWE-290

TI-2022-02630 CVE-2022-2837 · GHSA-h828-v5pv-33qx

Open redirect in coreDNS

LOW 27

A flaw was found in coreDNS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00388 Published 2023-03-03 No fix listed CWE-923

TI-2022-02629 CVE-2022-2835 · GHSA-ch7v-37xg-75ph

A flaw was found in coreDNS.

LOW 20

A flaw was found in coreDNS.

CVSS 3.1MEDIUM 4.4 Local Low privileges No interaction EPSS 0.00176 Published 2023-03-03 No fix listed CWE-923