CO
Product
coredns
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 11Medium 2Low 1
Watch
Add coredns to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86003 | 7.5 | Sep 16 | CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP Affected: < 1.14.7 |
| CVE-2026-82399 | 7.5 | Sep 16 | CoreDNS: Unauthenticated memory exhaustion in custom transports Affected: < 1.14.7 |
| CVE-2026-62309 | 7.5 | Jul 16 | CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS Affected: < 1.14.4 |
| CVE-2026-33489 | 7.5 | May 5 | CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison Affected: < 1.14.3 |
| CVE-2026-32936 | 7.5 | May 5 | CoreDNS DoH GET path missing size validation causes CPU and memory amplification Affected: < 1.14.3 |
| CVE-2026-32934 | 7.5 | May 5 | CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service Affected: < 1.14.3 |
| CVE-2026-33190 | 7.5 | May 5 | CoreDNS TSIG authentication bypass on encrypted DNS transports Affected: < 1.14.3 |
| CVE-2026-26018 | 7.5 | Mar 6 | CoreDNS Loop Detection Denial of Service Vulnerability Affected: < 1.14.2 |
| CVE-2025-68151 | 7.5 | Jan 8 | CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages Affected: < 1.14.0 |
| CVE-2025-47950 | 7.5 | Jun 6 | CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification Affected: < 1.12.2 |
| CVE-2025-58063 | 7.1 | Sep 9 | CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion Affected: >= 1.2.0, < 1.12.4 |
Showing 11