GO-2026-4630
and 9 other vulnerabilities
GO-2026-4630 : CoreDNS ACL Bypass in github.com/coredns/coredns
GO-2026-4635 : CoreDNS Loop Detection Denial of Service Vulnerability in github.com/coredns/coredns
GO-2026-4969 : CoreDNS' DoQ worker pool does not bound stream backlog in github.com/coredns/coredns
GO-2026-5164 : CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns
GO-2026-5417 : CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns
GO-2026-5583 : CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns
GO-2026-5667 : CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns
GO-2026-6506 : CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns
GO-2026-6507 : CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns
GO-2026-6805 : CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
Discover Packages
github.com/coredns/coredns
plugin
pkg
parse
package
Version:
v1.14.0
Opens a new window with list of versions in this module.
Published: Jan 7, 2026
License: Apache-2.0
Opens a new window with license information.
Imports: 8
Opens a new window with list of imports.
Imported by: 514
Opens a new window with list of known importers.
Documentation
¶
Package parse contains functions that can be used in the setup code for plugins.
ErrNoNameservers is returned by HostPortOrFile if no servers can be parsed.
HostPort will check if the host part is a valid IP address, if the
IP address is valid, but no port is found, defaultPort is added.
HostPortOrFile parses the strings in s, each string can either be a
address, [scheme://]address:port or a filename. The address part is checked
and in case of filename a resolv.conf like file is (assumed) and parsed and
the nameservers found are returned.
TransferIn parses transfer statements: 'transfer from [address...]'.
Transport returns the transport defined in s and a string where the
transport prefix is removed (if there was any). If no transport is defined
we default to TransportDNS
¶
Click to show internal directories.
Click to hide internal directories.
Affected by 
Documentation
¶
Source Files