VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/coredns/coredns: vulnerability history, versions and safety

github.com/coredns/coredns is a package in the Go ecosystem. Vulert records 37 vulnerabilities for it across 120 releases, from Mar 2022 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
37 vulnerabilities recorded H12 M7 L1 U17
i
4 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
22 in the last 12 months

Most recent disclosure 19 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/coredns/coredns vulnerabilities

Vulert verdict on github.com/coredns/coredns v1.15.0 i

Updated on 23 Oct 2026

Careful: v1.15.0 has 33 known vulnerabilities, and 4 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.15.0 — affected i
  • Vulnerabilities on record 37 over 4 years · 22 in the last year i
  • Latest disclosure 19 Oct 2026 i
  • Highest CVSS 7.7 i
  • With no published fix 4 i
  • Stars 14,391 i
  • OpenSSF scorecard 8/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/coredns/coredns, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.15.1-0.20261021154627-6687e6362dd3 21 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.15.1-0.20261021033441-3cbe6b5269be 21 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20261021021732-a6fde3fe339c 21 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.15.0 21 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20261020012935-653099f1cbbe 20 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261020012935-653099f1cbbe 20 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261019105415-1550b867f762 19 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261018070403-486ceaddd877 18 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20261016210628-d116ecb98ceb 16 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261016210628-d116ecb98ceb 16 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20261016022941-16b53a46c1d8 16 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261016022941-16b53a46c1d8 16 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261015081229-2e2324715bf0 15 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261014235902-9d1343c54c25 14 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261013115541-3580a2996e98 13 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261013074506-f0baaf05ddc7 13 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261012055740-235e7947cb65 12 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261009082835-123829d3b30b 09 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261009014810-ef18404448d3 09 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261008082527-e88652562073 08 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261007161018-763bdb9b7676 07 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20261005001452-49ceafa24ff8 05 Oct 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260930135946-f44a91377a0b 30 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260929081937-23ba070a81f2 29 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260928072239-72160e6e20c4 28 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20260924000202-95484f76edd9 24 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260924000202-95484f76edd9 24 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260923020809-615e3d4e11a3 23 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260922132320-d5c118884355 22 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260921194937-559e57ec55da 21 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260920043734-5cb7cdc914bd 20 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260918235631-ce5ee05bee93 18 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260917020801-010d8a8485d0 17 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260915074244-8de7a8b89ddc 15 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260914005730-22351a0d3c50 14 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260914005730-22351a0d3c50 14 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260912140441-24abd331e437 12 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260911200205-9221e099e442 11 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260911065933-19adcd8b960e 11 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260910010953-fb7e1d19fdce 10 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260909151328-27540c4f3de2 09 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260908045118-e1d3fe6bc660 08 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260908035054-71a60e140bdf 08 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260907024007-9fb1859b23b5 07 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260906003942-558c9757a92b 06 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260905092027-b564fcd86942 05 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260905011453-b6987aeb4a3c 05 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260903081133-c2e309e2e4ab 03 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260901094141-2ad79f66fa9a 01 Sep 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260829095923-c113fe48769e 29 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260827040828-dcd09b70fbf4 27 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260826223428-a15fc63b417a 26 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260826084128-70b5d6b5be1d 26 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260824005612-b8720090b52e 24 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260820092412-4b26cced3271 20 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.8-0.20260820032735-992d4c20dba7 20 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20260819003913-427fc80ed9ca 19 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7 19 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260818031232-9a623cdeed03 18 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260815032820-29ef323f8204 15 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260814142949-3d18244dd7cd 14 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260810202601-ea2eea57a74b 10 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260806041102-b2ef1a13e82c 06 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260804015045-19cd5fe0c33a 04 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260802144059-335c8b9a3354 02 Aug 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260730084402-3a52659cb881 30 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260727091325-76056dd2e56f 27 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260724221004-989bf4a9fd9a 24 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260723020709-73d1eacf8726 23 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260722172019-6407da1d3a5a 22 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260722171238-908c417901e6 22 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260722160211-e2cfeeaecc9f 22 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260722140759-899eac64d585 22 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260721225231-e0a8eb8a46cb 21 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260721095547-d1a6ab0eb93e 21 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260720215413-041023657775 20 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260720025912-98bdb44f4dff 20 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260719105242-201d86a09812 19 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260719033605-57f73b4a4340 19 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260716010603-e1f4d0cb90a5 16 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.6-0.20260715200341-d5e54040ffab 15 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260715200341-d5e54040ffab 15 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260715143023-8fe5801bf191 15 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260714003430-5131b8f9444b 14 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.7-0.20260710072439-2d42f0e8f55f 10 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20260710050435-424d125775cd 10 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.6 10 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.6-0.20260710004307-5cab9853cd80 10 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5 09 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260709174335-974d693e6fe8 09 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260709172145-ab318db7b4a3 09 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260709171513-2d106be341ae 09 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260708144412-a267ab209370 08 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260706054851-6662dd58eab8 06 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260705073915-31559f43e8d5 05 Jul 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260630110512-33266a45c794 30 Jun 2026 H11 M7 U15 Apache-2.0 No Details →
v0.0.0-20260629075923-4faf983fb60a 29 Jun 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260628052612-45a20ddcf1d3 28 Jun 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260625224932-1936a2bb40cd 25 Jun 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260623230235-fc447d0658b0 23 Jun 2026 H11 M7 U15 Apache-2.0 No Details →
v1.14.5-0.20260618012616-cc88c96e0e1d 18 Jun 2026 H11 M7 U15 — No Details →
v1.14.5-0.20260615005405-f2f5b5a1cc46 15 Jun 2026 H11 M7 U15 — No Details →
v1.14.5-0.20260611061346-d35a94f05a5f 11 Jun 2026 H11 M7 U15 — No Details →
v1.14.5-0.20260610142659-0a33a3d6a1c2 10 Jun 2026 H11 M7 U15 — No Details →
v0.0.0-20260609032251-232d7cac38fb 09 Jun 2026 H11 M7 U15 — No Details →
v1.14.4 09 Jun 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260608110944-b6e5859ee7be 08 Jun 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260603021140-c02e6dc8435b 03 Jun 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260529051135-33c71b155412 29 May 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260521065411-65d15af3a9f3 21 May 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260513142454-2214a0b72ac1 13 May 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260507001133-097e883c925c 07 May 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260430091716-145029c847d3 30 Apr 2026 H11 M7 U15 — No Details →
v1.14.4-0.20260422142343-a669d74088de 22 Apr 2026 H11 M7 U15 — No Details →
v0.0.0-20260422080354-17fceec6d93f 22 Apr 2026 H11 M7 U15 — No Details →
v1.14.3 22 Apr 2026 H11 M7 U15 — No Details →
v1.14.3-0.20260421213421-cf6a78f64d0e 21 Apr 2026 H11 M7 U15 — No Details →
v1.14.3-0.20260411101528-57a95e26778d 11 Apr 2026 H11 M7 U15 — No Details →
v1.14.3-0.20260409122400-c0e6e7cef31e 09 Apr 2026 H11 M7 U15 — No Details →
v1.14.3-0.20260404183751-5643d41ba747 04 Apr 2026 H11 M7 U15 — No Details →

The newest 120 of 1,407 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 1
  • 2023 3
  • 2024 7
  • 2025 4
  • 2026 22

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 22 of the 37 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/coredns/coredns

The 5 most severe of 37 vulnerabilities recorded for this package

Search all 37 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-26017: CoreDNS ACL Bypass Vulnerability 7.7 high 1.14.2 06 Mar 2026
CVE-2026-32934: CoreDNS DoQ Worker Pool Unbounded Stream Backlog Vulnerability 7.5 high 1.14.3 28 Apr 2026
CVE-2026-33489: CoreDNS Subzone ACL Bypass Vulnerability 7.5 high 1.14.3 28 Apr 2026
CVE-2026-33190: CoreDNS TSIG Authentication Bypass Vulnerability 7.5 high 1.14.3 28 Apr 2026
CVE-2026-32936: CoreDNS DoH GET Oversized Query Parameter Causes Denial of Service 7.5 high 1.14.3 28 Apr 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/coredns/coredns

Is github.com/coredns/coredns safe to use?

Vulert records 37 vulnerabilities for github.com/coredns/coredns in Go: 0 critical, 12 high, 7 medium and 1 low, plus 17 not yet rated. 4 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/coredns/coredns's Vulert package health score?

Vulert scores github.com/coredns/coredns 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/coredns/coredns affected?

Yes. v1.15.0, the version you would install today, has 33 known vulnerabilities, and 4 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/coredns/coredns have?

37 vulnerabilities are recorded for github.com/coredns/coredns in the Go ecosystem: 0 critical, 12 high, 7 medium and 1 low, plus 17 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/coredns/coredns vulnerabilities disclosed?

22 vulnerabilities were recorded for github.com/coredns/coredns in the last 12 months, and the oldest entry in this database dates to 01 Mar 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/coredns/coredns are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/coredns/coredns for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/coredns/coredns version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.