Количество 7
Количество 7
CVE-2026-33489
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
CVE-2026-33489
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
CVE-2026-33489
CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison
CVE-2026-33489
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14 ...
ROS-20260729-73-0026
Уязвимость coredns
GHSA-h8mm-c463-wjq3
CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass)
openSUSE-SU-2026:20703-1
Security update for coredns
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-33489 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3. | CVSS3: 6.5 | 0% Низкий | 3 месяца назад |
 | CVE-2026-33489 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3. | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
 | CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison | 0% Низкий | 3 месяца назад | |
| CVE-2026-33489 CoreDNS is a DNS server that chains plugins. In versions prior to 1.14 ... | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
 | ROS-20260729-73-0026 Уязвимость coredns | CVSS3: 7.5 | 0% Низкий | 10 дней назад |
| GHSA-h8mm-c463-wjq3 CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
 | openSUSE-SU-2026:20703-1 Security update for coredns | 3 месяца назад |
Уязвимостей на страницу