coredns vulnerabilities
CVEs whose affected-version data names the coredns package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-82399High· 7.5PoCCoreDNS is a DNS server written in Go
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call d…
CVE-2026-86003High· 7.5CoreDNS is a DNS server written in Go
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.M…
CVE-2026-26018High· 7.5CoreDNS is a DNS server that chains plugins
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. T…
CVE-2026-26017High· 7.7CoreDNS is a DNS server that chains plugins
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins such as acl are evaluated …
CVE-2025-68151High· 7.5CoreDNS is a DNS server that chains plugins
CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and d…
CVE-2024-0874Medium· 5.3A flaw was found in coredns
A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.