CoreDNS Cache Poisoning via a birthday attack

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-30464 · ADVISORY
• coredns/coredns commit 604a902 · WEB
• gist.github.com/idealeer/e41c7fb3b661d4262d0b6f21e12168ba · WEB
• coredns/coredns · PACKAGE
• GitHub Advisory GHSA-h92q-fgpp-qhrq · ADVISORY

Weitere Schwachstellen in github.com/coredns/coredns

• CVE-2026-86003HOCH 7.5CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in p…
• CVE-2026-82399HOCH 7.5CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths …
• CVE-2026-62994NIEDRIG 3.7CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger …
• CVE-2026-35579KRITISCH 9.8CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly hand…
• CVE-2026-33489HOCH 7.5CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a pa…