{"id":"openSUSE-SU-2026:22135-1","summary":"Security update for coredns","details":"This update for coredns fixes the following issues:\n\nChanges in coredns:\n\n- Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1:\n\n  * CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame\n    fragmentation in the gRPC transport (boo#1279216)\n  * Done through the go_modules \"require\" parameter in _service\n\n- Update license tag to Apache-2.0 AND MPL-2.0\n  * outcome of legal review\n\nUpdate to version 1.14.6:\n\n  * Test: populating build test failure\n  * fix(auto): keep first matching zone file for duplicate origins\n  * plugin/secondary: serve catalog member zones\n  * plugin/tsig: don't echo client's TSIG.Error if verification is successful\n  * docs(timeouts): document DoQ read timeout\n  * plugin/dnstap: fix self-deadlock in listener broadcast on client flush\n    error\n  * core/dnsserver: bound DoQ stream read with the server read timeout\n  * plugin/transfer: Fix panic in CoreDNS transfer plugin caused by empty DNS\n    record\n  * core/dnsserver: add Config.UDPDecorateWriterFunc for external plugins\n  * plugin/kubernetes: fix AXFR panic when nsAddrs returns multiple records\n  * plugin/hosts: fix data race between lookups and reload\n  * core/dnsserver: sanitize DoH/DoH3 request parse errors\n  * plugin/dnstap: close the previous connection before reconnecting\n  * plugin/erratic: apply default truncate amount of 2 for bare `truncate`\n  * Test: Fix flaky health test\n  * plugin/pkg/response: classify nxdomain without soa as denial\n  * plugin/file: return SOA in authority for negative CNAME target answers\n  * plugin/forward: make per-upstream read timeout configurable\n  * plugin/secondary: parse catalog zones after transfer\n  * plugin/pkg/dnsutil: guard Join against an empty label slice\n  * plugin/file: run additional processing for wildcard answers\n  * fix(tls): use Go TLS defaults\n  * plugin/secondary: stop update loop on reload shutdown\n  * fix(8201): restore old behavior forward plugin continue on empty conf file\n  * fix(forward): make dnstap FORWARDER_* describe the socket from CoreDNS to\n    upstream\n  * plugin/cache: add regression test for AD bit not partitioning the cache\n  * fix(rewrite): restore the original question on empty replies\n  * plugin/auto: warn on duplicate zone file origins\n  * test: use dynamic ports in reload tests\n  * plugin/transfer: configure notify source address\n  * fix: accept scoped IPv6 addresses in transfer targets\n  * fix(trace): correct Zipkin v2 endpoint docs\n  * fix(log): synthesize deferred error responses\n  * fix(dnstap): store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily\n    INET\n  * plugin/hosts: add wildcard support\n  * fix(local): handle names under .localhost.\n  * plugin/hosts: fall through unsupported query types\n  * plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no\n    OPT record\n  * feat(forward): add doh support\n  * core/dnsserver: propagate HTTPRequestValidateFunc to all configs in a server\n    block\n","modified":"2026-10-20T19:15:03.954979616Z","published":"2026-10-19T16:30:42Z","related":["CVE-2026-84304"],"upstream":["CVE-2026-84304"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279216"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84304"}],"affected":[{"package":{"name":"coredns","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/coredns&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-bp160.2.1"}]}],"ecosystem_specific":{"binaries":[{"coredns-extras":"1.14.7-bp160.2.1","coredns":"1.14.7-bp160.2.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22135-1.json"}}],"schema_version":"1.9.0"}