Skip to content
OpenAdvisories

Package · Go

github.com/coredns/coredns

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-62994

    CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

    CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless…

    coredns coredns github.com/coredns/coredns Go