CVE-2026-33489
Description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
How to fix
- coredns.io coredns1.14.3 or later
- github.com/coredns/coredns1.14.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| coredns.io coredns | v < 1.14.3 | 1.14.3 |
| github.com/coredns/corednsGo | v < 1.14.3 | 1.14.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.