openSUSE-SU-2026:22135-1

openSUSE-SU-2026:22135-1 · Security update for coredns

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This update for coredns fixes the following issues: Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: * CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport (boo#1279216) * Done through the go_modules "require" parameter in _service - Update license tag to Apache-2.0 AND MPL-2.0 * outcome of legal review Update to version 1.14.6: * Test: populating build test failure * fix(auto): keep first matching zone file for duplicate origins * plugin/secondary: serve catalog member zones * plugin/tsig: don't echo client's TSIG.Error if verification is successful * docs(timeouts): document DoQ read timeout * plugin/dnstap: fix self-deadlock in listener broadcast on client flush error * core/dnsserver: bound DoQ stream read with the server read timeout * plugin/transfer: Fix panic in CoreDNS transfer plugin caused by empty DNS record * core/dnsserver: add Config.UDPDecorateWriterFunc for external plugins * plugin/kubernetes: fix AXFR panic when nsAddrs returns multiple records * plugin/hosts: fix data race between lookups and reload * core/dnsserver: sanitize DoH/DoH3 request parse errors * plugin/dnstap: close the previous connection before reconnecting * plugin/erratic: apply default truncate amount of 2 for bare `truncate` * Test: Fix flaky health test * plugin/pkg/response: classify nxdomain without soa as denial * plugin/file: return SOA in authority for negative CNAME target answers * plugin/forward: make per-upstream read timeout configurable * plugin/secondary: parse catalog zones after transfer * plugin/pkg/dnsutil: guard Join against an empty label slice * plugin/file: run additional processing for wildcard answers * fix(tls): use Go TLS defaults * plugin/secondary: stop update loop on reload shutdown * fix(8201): restore old behavior forward plugin continue on empty conf file * fix(forward): make dnstap FORWARDER_* describe the socket from CoreDNS to upstream * plugin/cache: add regression test for AD bit not partitioning the cache * fix(rewrite): restore the original question on empty replies * plugin/auto: warn on duplicate zone file origins * test: use dynamic ports in reload tests * plugin/transfer: configure notify source address * fix: accept scoped IPv6 addresses in transfer targets * fix(trace): correct Zipkin v2 endpoint docs * fix(log): synthesize deferred error responses * fix(dnstap): store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET * plugin/hosts: add wildcard support * fix(local): handle names under .localhost. * plugin/hosts: fall through unsupported query types * plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record * feat(forward): add doh support * core/dnsserver: propagate HTTPRequestValidateFunc to all configs in a server block

Fix available

Published

2026-10-19T16:30:42Z

Updated

2026-10-20T19:15:03.954979616Z

Stack: system · network

Check your server →