Affected by GO-2026-4289
and 10 other vulnerabilities
GO-2026-4289: CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns
GO-2026-4630: CoreDNS ACL Bypass in github.com/coredns/coredns
GO-2026-4635: CoreDNS Loop Detection Denial of Service Vulnerability in github.com/coredns/coredns
GO-2026-4969: CoreDNS' DoQ worker pool does not bound stream backlog in github.com/coredns/coredns
GO-2026-5164: CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns
GO-2026-5417: CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns
GO-2026-5583: CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns
GO-2026-5667: CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns
GO-2026-6506: CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns
GO-2026-6507: CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns
GO-2026-6805: CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
Lookup routes lookups to our selves to make it follow the plugin chain *again*, but with a (possibly) new query. As
we are doing the query against ourselves again, there is no actual new hop, as such RFC 6891 does not apply and we
need the EDNS0 option present in the *original* query to be present here too.
Affected by 
Documentation
¶
Source Files