{"id":"openSUSE-SU-2026:22194-1","summary":"Security update for coredns","details":"This update for coredns fixes the following issues:\n\nChanges in coredns:\n\n- Update to 1.15.0:\n  * Fixes VUL-0: CVE-2026-78669: excessive CPU consumption in HTTP/2 (boo#1285501)\n    and CVE-2026-97032: HTTP/2 server crash due to HPACK encoder\n    race (boo#1287577) by bumping vendored golang.org/x/net to\n    v0.60.0.\n  * Drops temporary google.golang.org/grpc pin for CVE-2026-84304 as upstream\n    now vendors v1.84.0.\n  * plugin/cache: cache SERVFAIL when resolver fails without response\n  * plugin/forward: support DNS-over-QUIC upstreams\n  * core: add opt-in JSON logging with structured DNS query fields\n  * New features: SIIT support, expr-lang templates, PROXY protocol v2 metadata\n  * Bumped minimum go build requirement to 1.26.0\n  * Skip flaky timing/network-sensitive tests in %check (TestHealthMaxFails,\n    TestReconnect, TestRace, TestSecondaryZoneNotify, TestPeriodicWeightUpdate)\n","modified":"2026-11-01T17:23:31.026836066Z","published":"2026-10-27T14:58:53Z","related":["CVE-2026-78669","CVE-2026-97032"],"upstream":["CVE-2026-78669","CVE-2026-97032"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285501"},{"type":"REPORT","url":"https://bugzilla.suse.com/1287577"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78669"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-97032"}],"affected":[{"package":{"name":"coredns","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/coredns&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"coredns":"1.15.0-bp160.1.1","coredns-extras":"1.15.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22194-1.json"}}],"schema_version":"1.9.2"}