GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2026:20703-1

Vulnerability from csaf_opensuse - Published: 2026-05-06 17:18 - Updated: 2026-09-17 17:32
Summary
Security update for coredns
Severity
Important
Notes
Title of the patch: Security update for coredns
Description of the patch: This update for coredns fixes the following issues: Changes in coredns: - Update to version 1.14.3: * This release introduces Windows service support, along with full TSIG verification across DoH, DoH3, QUIC, and gRPC transports, and improved TSIG propagation and DoH request validation. * It also adds optional TLS for the metrics endpoint. * Performance and stability are improved through cache prefetching, QUIC optimizations, and a new max_age option in the forward plugin. * Additional updates include enhanced SVCB/HTTPS support, improved zone transfer behavior, and various DNSSEC, PROXY protocol, and concurrency fixes. * The release is built with Go 1.26.2, which includes security fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, and CVE-2026-27140, and also includes fixes for CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.
Patchnames: openSUSE-Leap-16.0-packagehub-233
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-27140
7 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2026-27143
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact important
CVE-2026-27144
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact moderate
CVE-2026-32282
6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact moderate
CVE-2026-32283
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact moderate
CVE-2026-32288
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact moderate
CVE-2026-32289
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact moderate
CVE-2026-32934
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact important
CVE-2026-32936
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact important
CVE-2026-33190
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact important
CVE-2026-33489
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact important
CVE-2026-33810
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact moderate
CVE-2026-35579
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-27140
Threats
Impact critical
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://www.suse.com/security/cve/CVE-2026-27140/ self
https://www.suse.com/security/cve/CVE-2026-27143/ self
https://www.suse.com/security/cve/CVE-2026-27144/ self
https://www.suse.com/security/cve/CVE-2026-32282/ self
https://www.suse.com/security/cve/CVE-2026-32283/ self
https://www.suse.com/security/cve/CVE-2026-32288/ self
https://www.suse.com/security/cve/CVE-2026-32289/ self
https://www.suse.com/security/cve/CVE-2026-32934/ self
https://www.suse.com/security/cve/CVE-2026-32936/ self
https://www.suse.com/security/cve/CVE-2026-33190/ self
https://www.suse.com/security/cve/CVE-2026-33489/ self
https://www.suse.com/security/cve/CVE-2026-33810/ self
https://www.suse.com/security/cve/CVE-2026-35579/ self
https://www.suse.com/security/cve/CVE-2026-27140 external
https://bugzilla.suse.com/1261653 external
https://www.suse.com/security/cve/CVE-2026-27143 external
https://bugzilla.suse.com/1261654 external
https://www.suse.com/security/cve/CVE-2026-27144 external
https://bugzilla.suse.com/1261655 external
https://www.suse.com/security/cve/CVE-2026-32282 external
https://bugzilla.suse.com/1261658 external
https://www.suse.com/security/cve/CVE-2026-32283 external
https://bugzilla.suse.com/1261659 external
https://bugzilla.suse.com/1268756 external
https://www.suse.com/security/cve/CVE-2026-32288 external
https://bugzilla.suse.com/1261660 external
https://bugzilla.suse.com/1268756 external
https://www.suse.com/security/cve/CVE-2026-32289 external
https://bugzilla.suse.com/1261661 external
https://www.suse.com/security/cve/CVE-2026-32934 external
https://bugzilla.suse.com/1264191 external
https://www.suse.com/security/cve/CVE-2026-32936 external
https://bugzilla.suse.com/1264192 external
https://www.suse.com/security/cve/CVE-2026-33190 external
https://bugzilla.suse.com/1264193 external
https://www.suse.com/security/cve/CVE-2026-33489 external
https://bugzilla.suse.com/1264194 external
https://www.suse.com/security/cve/CVE-2026-33810 external
https://bugzilla.suse.com/1261662 external
https://www.suse.com/security/cve/CVE-2026-35579 external
https://bugzilla.suse.com/1264195 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for coredns",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for coredns fixes the following issues:\n\nChanges in coredns:\n\n- Update to version 1.14.3:\n  * This release introduces Windows service support, along with full TSIG\n    verification across DoH, DoH3, QUIC, and gRPC transports, and improved\n    TSIG propagation and DoH request validation.\n  * It also adds optional TLS for the metrics endpoint.\n  * Performance and stability are improved through cache prefetching, QUIC\n    optimizations, and a new max_age option in the forward plugin.\n  * Additional updates include enhanced SVCB/HTTPS support, improved zone\n    transfer behavior, and various DNSSEC, PROXY protocol, and concurrency\n    fixes.\n  * The release is built with Go 1.26.2, which includes security\n    fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810,\n    CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283,\n    and CVE-2026-27140, and also includes fixes for CVE-2026-32936,\n    CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-233",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20703-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27140 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27140/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27143 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27143/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27144 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27144/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32282 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32282/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32283 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32283/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32288 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32288/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32289 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32289/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32934 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32934/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-32936 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-32936/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33190 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33190/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33489 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33489/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33810 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33810/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-35579 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-35579/"
      }
    ],
    "title": "Security update for coredns",
    "tracking": {
      "current_release_date": "2026-09-17T17:32:08Z",
      "generator": {
        "date": "2026-05-06T17:18:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20703-1",
      "initial_release_date": "2026-05-06T17:18:02Z",
      "revision_history": [
        {
          "date": "2026-05-06T17:18:02Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:34:38Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:37:32Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:32:08Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "coredns-0:1.14.3-bp160.1.1.aarch64",
                "product": {
                  "name": "coredns-0:1.14.3-bp160.1.1.aarch64",
                  "product_id": "coredns-0:1.14.3-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:coredns.io:coredns:1.14.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/coredns@1.14.3-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "coredns-extras-0:1.14.3-bp160.1.1.noarch",
                "product": {
                  "name": "coredns-extras-0:1.14.3-bp160.1.1.noarch",
                  "product_id": "coredns-extras-0:1.14.3-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/coredns-extras@1.14.3-bp160.1.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "coredns-0:1.14.3-bp160.1.1.ppc64le",
                "product": {
                  "name": "coredns-0:1.14.3-bp160.1.1.ppc64le",
                  "product_id": "coredns-0:1.14.3-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:coredns.io:coredns:1.14.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/coredns@1.14.3-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "coredns-0:1.14.3-bp160.1.1.x86_64",
                "product": {
                  "name": "coredns-0:1.14.3-bp160.1.1.x86_64",
                  "product_id": "coredns-0:1.14.3-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:coredns.io:coredns:1.14.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/coredns@1.14.3-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "coredns-0:1.14.3-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64"
        },
        "product_reference": "coredns-0:1.14.3-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "coredns-0:1.14.3-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le"
        },
        "product_reference": "coredns-0:1.14.3-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "coredns-0:1.14.3-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64"
        },
        "product_reference": "coredns-0:1.14.3-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "coredns-extras-0:1.14.3-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        },
        "product_reference": "coredns-extras-0:1.14.3-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27140",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27140"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SWIG file names containing \u0027cgo\u0027 and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27140",
          "url": "https://www.suse.com/security/cve/CVE-2026-27140"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261653 for CVE-2026-27140",
          "url": "https://bugzilla.suse.com/1261653"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27140"
    },
    {
      "cve": "CVE-2026-27143",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27143"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27143",
          "url": "https://www.suse.com/security/cve/CVE-2026-27143"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261654 for CVE-2026-27143",
          "url": "https://bugzilla.suse.com/1261654"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27143"
    },
    {
      "cve": "CVE-2026-27144",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27144"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27144",
          "url": "https://www.suse.com/security/cve/CVE-2026-27144"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261655 for CVE-2026-27144",
          "url": "https://bugzilla.suse.com/1261655"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-27144"
    },
    {
      "cve": "CVE-2026-32282",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32282"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32282",
          "url": "https://www.suse.com/security/cve/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261658 for CVE-2026-32282",
          "url": "https://bugzilla.suse.com/1261658"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-32282"
    },
    {
      "cve": "CVE-2026-32283",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32283"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32283",
          "url": "https://www.suse.com/security/cve/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261659 for CVE-2026-32283",
          "url": "https://bugzilla.suse.com/1261659"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268756 for CVE-2026-32283",
          "url": "https://bugzilla.suse.com/1268756"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-32283"
    },
    {
      "cve": "CVE-2026-32288",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32288"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32288",
          "url": "https://www.suse.com/security/cve/CVE-2026-32288"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261660 for CVE-2026-32288",
          "url": "https://bugzilla.suse.com/1261660"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268756 for CVE-2026-32288",
          "url": "https://bugzilla.suse.com/1268756"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-32288"
    },
    {
      "cve": "CVE-2026-32289",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32289"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32289",
          "url": "https://www.suse.com/security/cve/CVE-2026-32289"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261661 for CVE-2026-32289",
          "url": "https://bugzilla.suse.com/1261661"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-32289"
    },
    {
      "cve": "CVE-2026-32934",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32934"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32934",
          "url": "https://www.suse.com/security/cve/CVE-2026-32934"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264191 for CVE-2026-32934",
          "url": "https://bugzilla.suse.com/1264191"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32934"
    },
    {
      "cve": "CVE-2026-32936",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-32936"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-32936",
          "url": "https://www.suse.com/security/cve/CVE-2026-32936"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264192 for CVE-2026-32936",
          "url": "https://bugzilla.suse.com/1264192"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-32936"
    },
    {
      "cve": "CVE-2026-33190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer\u0027s TsigStatus() instead of performing verification itself. The DoH and DoH3 writer\u0027s TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33190",
          "url": "https://www.suse.com/security/cve/CVE-2026-33190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264193 for CVE-2026-33190",
          "url": "https://bugzilla.suse.com/1264193"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33190"
    },
    {
      "cve": "CVE-2026-33489",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33489"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., \"example.org.\" \u003e \"a.example.org.\" lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33489",
          "url": "https://www.suse.com/security/cve/CVE-2026-33489"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264194 for CVE-2026-33489",
          "url": "https://bugzilla.suse.com/1264194"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33489"
    },
    {
      "cve": "CVE-2026-33810",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33810"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33810",
          "url": "https://www.suse.com/security/cve/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261662 for CVE-2026-33810",
          "url": "https://bugzilla.suse.com/1261662"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33810"
    },
    {
      "cve": "CVE-2026-35579",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-35579"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configuration but never calls dns.TsigVerify() to validate the HMAC. If the key name matches a configured key, the tsigStatus field remains nil and the tsig plugin treats the request as successfully authenticated regardless of the MAC value. For DoH and DoH3, the issue is more severe: the DoHWriter.TsigStatus() method unconditionally returns nil, and the server never inspects the TSIG record at all. Any request containing a TSIG record is treated as authenticated over DoH and DoH3, even if the key name is invalid and the MAC is arbitrary.\n\nAn unauthenticated network attacker can exploit this to bypass TSIG-protected functionality such as AXFR/IXFR zone transfers, dynamic DNS updates, or other TSIG-gated plugin behavior. The DoH and DoH3 variants have a lower exploitation bar because the attacker does not need to know a valid TSIG key name.\n\nThis issue has been fixed in version 1.14.3. As a workaround, disable gRPC, QUIC, DoH, and DoH3 listeners where TSIG authentication is required, or restrict network-level access to affected transport ports to trusted sources only.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-35579",
          "url": "https://www.suse.com/security/cve/CVE-2026-35579"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264195 for CVE-2026-35579",
          "url": "https://bugzilla.suse.com/1264195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:coredns-0:1.14.3-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:coredns-extras-0:1.14.3-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T17:18:02Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-35579"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.