Affected by GO-2026-4630
and 9 other vulnerabilities
GO-2026-4630 : CoreDNS ACL Bypass in github.com/coredns/coredns
GO-2026-4635 : CoreDNS Loop Detection Denial of Service Vulnerability in github.com/coredns/coredns
GO-2026-4969 : CoreDNS' DoQ worker pool does not bound stream backlog in github.com/coredns/coredns
GO-2026-5164 : CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns
GO-2026-5417 : CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns
GO-2026-5583 : CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns
GO-2026-5667 : CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns
GO-2026-6506 : CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns
GO-2026-6507 : CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns
GO-2026-6805 : CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
Discover Packages
github.com/coredns/coredns
plugin
pkg
fall
package
Version:
v1.14.0
Opens a new window with list of versions in this module.
Published: Jan 7, 2026
License: Apache-2.0
Opens a new window with license information.
Imports: 2
Opens a new window with list of imports.
Imported by: 424
Opens a new window with list of known importers.
Documentation
Documentation
¶
Package fall handles the fallthrough logic used in plugins that support it. Be careful when including this
functionality in your plugin. Why? In the DNS only 1 source is authoritative for a set of names. Fallthrough
breaks this convention by allowing a plugin to query multiple sources, depending on the replies it got sofar.
This may cause issues in downstream caches, where different answers for the same query can potentially confuse clients.
On the other hand this is a powerful feature that can aid in migration or other edge cases.
The take away: be mindful of this and don't blindly assume it's a good feature to have in your plugin.
See https://github.com/coredns/coredns/issues/2723 for some discussion on this, which includes this quote:
TL;DR: `fallthrough` is indeed risky and hackish, but still a good feature of CoreDNS as it allows to quickly answer boring edge cases.
Root returns F set to only ".".
Zero returns a zero valued F.
type F struct {
Zones []string
}
F can be nil to allow for no fallthrough, empty allow all zones to fallthrough or
contain a zone list that is checked.
Equal returns true if f and g are equal.
func (f *F ) SetZonesFromArgs(zones []string )
SetZonesFromArgs sets zones in f to the passed value or to "." if the slice is empty.
Through will check if we should fallthrough for qname. Note that we've named the
variable in each plugin "Fall", so this then reads Fall.Through().
Source Files
¶
Click to show internal directories.
Click to hide internal directories.