openSUSE-SU-2026:21674-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21674-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21674-1
Upstream
Related
Published
2026-08-28T20:48:12Z
Modified
2026-08-30T13:00:04Z
Summary
Security update for coredns
Details

This update for coredns fixes the following issues:

Changes in coredns:

  • Update to version 1.14.7:
    • plugin/acl, plugin/cache, plugin/file, plugin/forward, plugin/kubernetes: assorted correctness fixes (stale-cache races, AXFR zone contamination, DoH health-check TLS config, failover counter reset, ACL bypass via autopath).
    • New: plugin/shed (UDP overload protection), plugin/tls (ACME DNS-01), plugin/timeouts maxtcpqueries, DoQ connection-level concurrency limits.
  • CVE-2026-41178: go.opentelemetry.io/otel/baggage header parsing did not reject excessively large raw values, allowing a denial of service via oversized input; fixed by the otel bump to v1.44.0 pulled in with this update (boo#1276712)
References

Affected packages

openSUSE:Leap 16.0 / coredns

Package

Name
coredns
Purl
pkg:rpm/opensuse/coredns&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.14.7-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "coredns":  "1.14.7-bp160.1.1",
            "coredns-extras":  "1.14.7-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21674-1.json"