openSUSE-SU-2026:22194-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22194-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22194-1
Upstream
CVE (2)
  • CVE-2026-78669
  • CVE-2026-97032
Related
CVE (2)
  • CVE-2026-78669
  • CVE-2026-97032
Published
2026-10-27T14:58:53Z
Modified
2026-11-01T17:23:31Z
Summary
Security update for coredns
Details

This update for coredns fixes the following issues:

Changes in coredns:

  • Update to 1.15.0:
    • Fixes VUL-0: CVE-2026-78669: excessive CPU consumption in HTTP/2 (boo#1285501) and CVE-2026-97032: HTTP/2 server crash due to HPACK encoder race (boo#1287577) by bumping vendored golang.org/x/net to v0.60.0.
    • Drops temporary google.golang.org/grpc pin for CVE-2026-84304 as upstream now vendors v1.84.0.
    • plugin/cache: cache SERVFAIL when resolver fails without response
    • plugin/forward: support DNS-over-QUIC upstreams
    • core: add opt-in JSON logging with structured DNS query fields
    • New features: SIIT support, expr-lang templates, PROXY protocol v2 metadata
    • Bumped minimum go build requirement to 1.26.0
    • Skip flaky timing/network-sensitive tests in %check (TestHealthMaxFails, TestReconnect, TestRace, TestSecondaryZoneNotify, TestPeriodicWeightUpdate)
References

Affected packages

openSUSE:Leap 16.0 / coredns

Package

Name
coredns
Purl
pkg:rpm/opensuse/coredns&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.15.0-bp160.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "coredns": "1.15.0-bp160.1.1",
            "coredns-extras": "1.15.0-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22194-1.json"