CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.

An update of the coredns package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20703-1 advisory.

    Changes in coredns:

    - Update to version 1.14.3:
      * This release introduces Windows service support, along with full TSIG         verification across DoH, DoH3, QUIC, and gRPC transports, and improved         TSIG propagation and DoH request validation.
      * It also adds optional TLS for the metrics endpoint.
      * Performance and stability are improved through cache prefetching, QUIC         optimizations, and a new max_age option in the forward plugin.
      * Additional updates include enhanced SVCB/HTTPS support, improved zone         transfer behavior, and various DNSSEC, PROXY protocol, and concurrency         fixes.
      * The release is built with Go 1.26.2, which includes security         fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810,         CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283,         and CVE-2026-27140, and also includes fixes for CVE-2026-32936,         CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server
    can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams
    and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per
    accepted stream to wait for a worker token. Additionally, active workers block indefinitely in
    io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a
    single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an
    unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in
    version 1.14.3. No known workarounds exist. (CVE-2026-32934)

ID	Name	Product	Family	Severity
321834	Photon OS 4.0: Coredns PHSA-2026-4.0-1038	Nessus	PhotonOS Local Security Checks	high
321475	Photon OS 5.0: Coredns PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	high
313705	openSUSE 16 Security Update : coredns (openSUSE-SU-2026:20703-1)	Nessus	SuSE Local Security Checks	high
440949	SCA: security update for github.com/coredns/coredns (GHSA-2wpx-qpw2-g5h5)	Tenable Cloud Security	SCA Checks	high
440949	SCA: security update for github.com/coredns/coredns (GHSA-2wpx-qpw2-g5h5)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-32934

high

Tenable Plugins

high

high

high

high

high