Detections
Analytics
openSUSE 16 Security Update : coredns (openSUSE-SU-2026:22135-1)
high Nessus Plugin ID 370423
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22135-1 advisory.Changes in coredns:
- Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1:
* CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport (boo#1279216)
* Done through the go_modules require parameter in _service
- Update license tag to Apache-2.0 AND MPL-2.0
* outcome of legal review
Update to version 1.14.6:
* Test: populating build test failure
* fix(auto): keep first matching zone file for duplicate origins
* plugin/secondary: serve catalog member zones
* plugin/tsig: don't echo client's TSIG.Error if verification is successful
* docs(timeouts): document DoQ read timeout
* plugin/dnstap: fix self-deadlock in listener broadcast on client flush error
* core/dnsserver: bound DoQ stream read with the server read timeout
* plugin/transfer: Fix panic in CoreDNS transfer plugin caused by empty DNS record
* core/dnsserver: add Config.UDPDecorateWriterFunc for external plugins
* plugin/kubernetes: fix AXFR panic when nsAddrs returns multiple records
* plugin/hosts: fix data race between lookups and reload
* core/dnsserver: sanitize DoH/DoH3 request parse errors
* plugin/dnstap: close the previous connection before reconnecting
* plugin/erratic: apply default truncate amount of 2 for bare `truncate`
* Test: Fix flaky health test
* plugin/pkg/response: classify nxdomain without soa as denial
* plugin/file: return SOA in authority for negative CNAME target answers
* plugin/forward: make per-upstream read timeout configurable
* plugin/secondary: parse catalog zones after transfer
* plugin/pkg/dnsutil: guard Join against an empty label slice
* plugin/file: run additional processing for wildcard answers
* fix(tls): use Go TLS defaults
* plugin/secondary: stop update loop on reload shutdown
* fix(8201): restore old behavior forward plugin continue on empty conf file
* fix(forward): make dnstap FORWARDER_* describe the socket from CoreDNS to upstream
* plugin/cache: add regression test for AD bit not partitioning the cache
* fix(rewrite): restore the original question on empty replies
* plugin/auto: warn on duplicate zone file origins
* test: use dynamic ports in reload tests
* plugin/transfer: configure notify source address
* fix: accept scoped IPv6 addresses in transfer targets
* fix(trace): correct Zipkin v2 endpoint docs
* fix(log): synthesize deferred error responses
* fix(dnstap): store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET
* plugin/hosts: add wildcard support
* fix(local): handle names under .localhost.
* plugin/hosts: fall through unsupported query types
* plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record
* feat(forward): add doh support
* core/dnsserver: propagate HTTPRequestValidateFunc to all configs in a server block
Tenable has extracted the preceding description block directly from the SUSE security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected coredns and / or coredns-extras packages.See Also
Plugin Details
Severity: High
ID: 370423
File Name: openSUSE-2026-22135-1.nasl
Version: 1.1
Type: Local
Agent: unix
Family: SuSE Local Security Checks
Published: 10/22/2026
Updated: 10/22/2026
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.6
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-84304
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 6.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:coredns-extras, p-cpe:/a:novell:opensuse:coredns
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 10/19/2026
Vulnerability Publication Date: 9/1/2026
Reference Information
CVE: CVE-2026-84304