There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability
    exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending
    specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number
    generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates
    the entire process. This issue has been patched in version 1.14.2. (CVE-2026-26018)

An update of the coredns package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20619-1 advisory.

    Changes in coredns:

    - Update to version 1.14.2:
      * plugin/reload: Allow disabling jitter with 0s
      * bump deps
      * plugin/forward: fix parsing error when handling TLS+IPv6 address
      * plugin/loop: use crypto/rand for query name generation
      * plugin: reorder rewrite before acl to prevent bypass
      * fix(rewrite): fix cname target rewrite for CNAME chains
      * fix(kubernetes): panic on empty ListenHosts
      * chore: bump minimum Go version to 1.25
      * feat(proxyproto): add proxy protocol support
      * refactor(cache): modernize with generics
      * Add metadata for response Type and Class to Log
      * docs: clarify kubernetes auth docs
      * fix: return SOA and NS records when queried for a record CNAMEd to origin

    - fixes bsc#1259320 CVE-2026-26017
    - fixes bsc#1259319 CVE-2026-26018

    - address more unstable unstable tests under aarch64 and s390x

    - Update to version 1.14.1:
      * This release primarily addresses security vulnerabilities affecting Go         versions prior to Go 1.25.6 and Go 1.24.12         (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731,          CVE-2025-68119).
         It also includes performance improvements to the proxy plugin via          multiplexed connections, along with various documentation updates.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
438473	SCA: security update for github.com/coredns/coredns (GHSA-h75p-j8xm-m278)	Tenable Self-Hosted Container Security	SCA Checks	3/7/2026	7/2/2026	high
438473	SCA: security update for github.com/coredns/coredns (GHSA-h75p-j8xm-m278)	Tenable Cloud Security	SCA Checks	3/7/2026	7/2/2026	high
457154	Echo: github.com/coredns/coredns: security update to 1.14.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/2/2026	10/5/2026	high
457154	Echo: github.com/coredns/coredns: security update to 1.14.2	Tenable Cloud Security	Echo Local Security Checks	10/2/2026	10/5/2026	high
321475	Photon OS 5.0: Coredns PHSA-2026-5.0-0869	Nessus	PhotonOS Local Security Checks	6/17/2026	10/14/2026	high
332514	Photon OS 5.0: Coredns PHSA-2026-5.0-91-0794	Nessus	PhotonOS Local Security Checks	8/5/2026	11/2/2026	medium
332431	Photon OS 5.0: Coredns PHSA-2026-5.0-90-0869	Nessus	PhotonOS Local Security Checks	8/5/2026	11/2/2026	high
303584	Photon OS 5.0: Coredns PHSA-2026-5.0-0794	Nessus	PhotonOS Local Security Checks	3/25/2026	10/14/2026	medium
303948	Photon OS 4.0: Coredns PHSA-2026-4.0-0984	Nessus	PhotonOS Local Security Checks	3/27/2026	11/2/2026	high
310251	openSUSE 16 Security Update : coredns (openSUSE-SU-2026:20619-1)	Nessus	SuSE Local Security Checks	4/25/2026	4/25/2026	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

medium

high

medium

high

critical