https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T08:43:24.016788+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338386 EUVD-2026-338386 2026-10-04T08:43:24.062005+00:00 EUVD-2026-338386 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62994 fkie_cve-2026-62994 2026-10-04T08:43:24.062045+00:00

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-62994 msrc_CVE-2026-62994 — CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin 2026-10-04T08:43:24.062082+00:00 msrc_CVE-2026-62994 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2271 WID-SEC-W-2026-2271 — CoreDNS: Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-04T08:43:24.062101+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CoreDNS ausnutzen, um einen Denial of Service Angriff durchzuführen.