Vulnerability GO-2026-6805
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
October 19, 2026 at 09:08 PM UTC
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
v1.9.4 - v1.14.4
v1.9.4 - v1.14.4
Summary
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
Details
CoreDNS k8s_external headless AXFR can emit an empty transfer batch that panics the transfer plugin in github.com/coredns/coredns
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
3 days ago
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
v1.9.4 - v1.14.4 GHSA-74w3-63xv-x9mv
v1.9.4 - v1.14.4 GHSA-74w3-63xv-x9mv
Unknown
21 days ago
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP in github.com/coredns/coredns
v0.9.9 - v1.14.6 GO-2026-6506
v0.9.9 - v1.14.6 GO-2026-6506
Unknown
21 days ago
CoreDNS: Unauthenticated memory exhaustion in custom transports in github.com/coredns/coredns
v0.9.9 - v1.14.6 GO-2026-6507
v0.9.9 - v1.14.6 GO-2026-6507
High Risk
1 month ago
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
v0.9.9 - v1.14.6 GHSA-9gm5-9rfh-m6vx
v0.9.9 - v1.14.6 GHSA-9gm5-9rfh-m6vx
High Risk
1 month ago
CoreDNS: Unauthenticated memory exhaustion in custom transports
v0.9.9 - v1.14.6 GHSA-mrg3-qvqr-jw29
v0.9.9 - v1.14.6 GHSA-mrg3-qvqr-jw29
Impacted packages
Timeline
Published
5 hours ago
October 19, 2026 at 09:08 PM UTC
Fixed (v1.14.5)
3 months ago
July 09, 2026 at 11:49 PM UTC
Last Modified
4 hours ago
October 19, 2026 at 09:31 PM UTC