CVE-2026-33489
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
CoreDNS versions prior to 1.14.3 have a vulnerability in the transfer plugin that can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
Risk Assessment
An unauthorized remote attacker can retrieve the full DNS zone contents of a subzone, potentially revealing sensitive information about the network infrastructure.
Recommendation
Update CoreDNS to version 1.14.3 or later, which includes the fix.
Other vulnerabilities in CoreDNS
See all- CVE-2025-68151Medium
CoreDNS before version 1.14.0 has a vulnerability in gRPC, HTTPS, and HTTP/3 server implementations that lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections.
- CVE-2026-35579Critical
CoreDNS versions prior to 1.14.3 incorrectly handle TSIG authentication in gRPC, QUIC, DoH, and DoH3 transports. For gRPC and QUIC, the server only checks the TSIG key name but does not validate the HMAC, so any request with a matching key name is considered authenticated. For DoH and DoH3, the issue is more severe – the server never inspects the TSIG record at all, so any request with TSIG is treated as authenticated.
- CVE-2026-62994Low
In CoreDNS from version 1.9.4 to 1.14.5, a network DNS client requesting AXFR zone transfer can trigger a panic when configured with k8s_external headless-service zone transfers and a headless service endpoint with no declared ports. Fixed in version 1.14.5.
- CVE-2026-62309High
Vulnerability in CoreDNS before version 1.14.4 allows a single 28-byte UDP datagram to crash the process when the proxyproto plugin is enabled. The bug is in handling PROXY v2 headers with non-UDP transport.
- CVE-2026-62299Medium
CoreDNS prior to 1.14.5 has a vulnerability in the rewrite plugin where a missing nil check after calling res.IsEdns0() can cause a panic and crash the process. A remote, unauthenticated client can send a single DNS query to trigger this, degrading availability.
- CVE-2026-33190High
CoreDNS before version 1.14.3 allows TSIG authentication bypass on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, gRPC). The tsig plugin trusts the transport writer's TsigStatus(), which always returns nil for DoH/DoH3/DoQ/gRPC and does not set TsigSecret for DoT. This lets an unauthenticated client access resources protected by a tsig require all policy.
- CVE-2026-32936High
CoreDNS versions prior to 1.14.3 have a vulnerability that allows oversized dns= query parameter values in DoH GET requests, leading to expensive processing before rejecting the request. This issue has been fixed in version 1.14.3.
- CVE-2026-32934High
CoreDNS versions prior to 1.14.3 have a vulnerability that allows a remote client to cause unbounded goroutine and memory growth by opening many QUIC streams and sending only 1 byte per stream. This issue has been fixed in version 1.14.3.
- CVE-2026-26018High
A denial of service vulnerability exists in CoreDNS before version 1.14.2 in the loop detection plugin. An attacker can send specially crafted DNS queries that exploit a predictable pseudo-random number generator (PRNG) for generating a secret query name, causing a fatal error that terminates the entire DNS server process.
- CVE-2026-26017High
A logical vulnerability in CoreDNS before version 1.14.2 allows DNS access controls to be bypassed due to the default execution order of plugins. Security plugins like acl are evaluated before the rewrite plugin, causing a Time-of-Check Time-of-Use (TOCTOU) flaw.
Original NVD description (English source)
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.