Affected by GO-2025-3942
and 8 other vulnerabilities
GO-2025-3942: CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns
GO-2026-4289: CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns
GO-2026-4630: CoreDNS ACL Bypass in github.com/coredns/coredns
GO-2026-4635: CoreDNS Loop Detection Denial of Service Vulnerability in github.com/coredns/coredns
GO-2026-4969: CoreDNS' DoQ worker pool does not bound stream backlog in github.com/coredns/coredns
GO-2026-5164: CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns
GO-2026-5417: CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns
GO-2026-5583: CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns
GO-2026-5667: CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns
Package up is used to run a function for some duration. If a new function is added while a previous run is
still ongoing, nothing new will be executed.
type Probe struct {
sync.Mutex// contains filtered or unexported fields
}
Probe is used to run a single Func until it returns true (indicating a target is healthy). If an Func
is already in progress no new one will be added, i.e. there is always a maximum of 1 checks in flight.
There is a tradeoff to be made in figuring out quickly that an upstream is healthy and not doing much work
(sending queries) to find that out. Having some kind of exp. backoff here won't help much, because you don't want
to backoff too much. You then also need random queries to be performed every so often to quickly detect a working
upstream. In the end we just send a query every 0.5 second to check the upstream. This hopefully strikes a balance
between getting information about the upstream state quickly and not doing too much work. Note that 0.5s is still an
eternity in DNS, so we may actually want to shorten it.