Affected by GO-2024-3130
and 10 other vulnerabilities
GO-2024-3130: CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns
GO-2025-3743: CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification in github.com/coredns/coredns
GO-2025-3942: CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns
GO-2026-4289: CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages in github.com/coredns/coredns
GO-2026-4630: CoreDNS ACL Bypass in github.com/coredns/coredns
GO-2026-4635: CoreDNS Loop Detection Denial of Service Vulnerability in github.com/coredns/coredns
GO-2026-4969: CoreDNS' DoQ worker pool does not bound stream backlog in github.com/coredns/coredns
GO-2026-5164: CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification in github.com/coredns/coredns
GO-2026-5417: CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns
GO-2026-5583: CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC in github.com/coredns/coredns
GO-2026-5667: CoreDNS has TSIG authentication bypass on gRPC and QUIC transports in github.com/coredns/coredns
Package fall handles the fallthrough logic used in plugins that support it. Be careful when including this
functionality in your plugin. Why? In the DNS only 1 source is authoritative for a set of names. Fallthrough
breaks this convention by allowing a plugin to query multiple sources, depending on the replies it got sofar.
This may cause issues in downstream caches, where different answers for the same query can potentially confuse clients.
On the other hand this is a powerful feature that can aid in migration or other edge cases.
The take away: be mindful of this and don't blindly assume it's a good feature to have in your plugin.
Affected by 
Documentation
¶
Source Files