CVE-2026-35579

< 1.14.3

CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorr

9.8CRITICAL

CVE-2026-33489

< 1.14.3

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when

7.5HIGH

CVE-2026-33190

< 1.14.3

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transpo

7.5HIGH

CVE-2026-32936

< 1.14.3

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns=

7.5HIGH

CVE-2026-32934

< 1.14.3

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unboun

7.5HIGH

CVE-2026-26018

< 1.14.2

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop d

7.5HIGH

CVE-2026-26017

< 1.14.2

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a logical vulnerability in CoreDNS allows DNS access control

7.7HIGH

CVE-2025-68151

< 1.14.0

CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HT

7.5HIGH

CVE-2025-47950

< 1.12.2

CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the Co

7.5HIGH

CVE-2023-30464

<= 1.10.1

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.

7.5HIGH

CVE-2023-28452

<= 1.10.1

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver t

7.5HIGH

CVE-2022-2837

all versions

A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) t

6.1MEDIUM

CVE-2022-2835

all versions

A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were acces

4.4MEDIUM