OESA-2026-4018 (CVE-2023-28452)

Vulnerability from osv_openeuler – Published: 2026-09-25 01:27 – Updated: 2026-09-25 01:27 – Source website
VLAI
Summary
coredns security update
Details

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins.

Security Fix(es):

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.(CVE-2023-28452)

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.(CVE-2023-30464)

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.(CVE-2026-32936)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "coredns-1.7.0-1.10.oe2403sp3.aarch64.rpm",
          "coredns-help-1.7.0-1.10.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "coredns-1.7.0-1.10.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "coredns-1.7.0-1.10.oe2403sp3.x86_64.rpm",
          "coredns-help-1.7.0-1.10.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "coredns",
        "purl": "pkg:rpm/openEuler/coredns\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.0-1.10.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "coredns-1.7.0-1.10.oe2403sp4.aarch64.rpm",
          "coredns-help-1.7.0-1.10.oe2403sp4.aarch64.rpm"
        ],
        "src": [
          "coredns-1.7.0-1.10.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "coredns-1.7.0-1.10.oe2403sp4.x86_64.rpm",
          "coredns-help-1.7.0-1.10.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "coredns",
        "purl": "pkg:rpm/openEuler/coredns\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.0-1.10.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "coredns-1.7.0-1.7.oe2003sp4.aarch64.rpm",
          "coredns-help-1.7.0-1.7.oe2003sp4.aarch64.rpm"
        ],
        "src": [
          "coredns-1.7.0-1.7.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "coredns-1.7.0-1.7.oe2003sp4.x86_64.rpm",
          "coredns-help-1.7.0-1.7.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "coredns",
        "purl": "pkg:rpm/openEuler/coredns\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.0-1.7.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "coredns-1.7.0-1.9.oe2203sp4.aarch64.rpm",
          "coredns-help-1.7.0-1.9.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "coredns-1.7.0-1.9.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "coredns-1.7.0-1.9.oe2203sp4.x86_64.rpm",
          "coredns-help-1.7.0-1.9.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "coredns",
        "purl": "pkg:rpm/openEuler/coredns\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.0-1.9.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "coredns-1.7.0-1.10.oe2403sp1.aarch64.rpm",
          "coredns-help-1.7.0-1.10.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "coredns-1.7.0-1.10.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "coredns-1.7.0-1.10.oe2403sp1.x86_64.rpm",
          "coredns-help-1.7.0-1.10.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "coredns",
        "purl": "pkg:rpm/openEuler/coredns\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.0-1.10.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.(CVE-2023-28452)\n\nCoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.(CVE-2023-30464)\n\nCoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.(CVE-2026-32936)",
  "id": "OESA-2026-4018",
  "modified": "2026-09-25T01:27:22Z",
  "published": "2026-09-25T01:27:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4018"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28452"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30464"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32936"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "coredns security update",
  "upstream": [
    "CVE-2023-28452",
    "CVE-2023-30464",
    "CVE-2026-32936"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.