Go/github.com/coredns/coredns CVE-2026-33489: high 7.5, EPSS 0.40%

CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns

Action: Upgrade github.com/coredns/coredns to 1.14.3 or later.

go get github.com/coredns/coredns@v1.14.3

Affected

Fixed versions

Sources

• osv: GO-2026-5417
• nvd: CVE-2026-33489
• https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3
• https://github.com/coredns/coredns/releases/tag/v1.14.3

CVE-2026-33489 · published 2026-06-25T22:34:31Z · modified 2026-06-25T23:00:16.224085006Z · JSON