Vulnerability Description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Coredns.Io | Coredns | < 1.14.3 |
Related Weaknesses (CWE)
References
- https://github.com/coredns/coredns/releases/tag/v1.14.3Release Notes
- https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3ExploitVendor Advisory
- https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3ExploitVendor Advisory
FAQ
What is CVE-2026-33489?
CVE-2026-33489 is a vulnerability with a CVSS score of 7.5 (HIGH). CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The lo...
How severe is CVE-2026-33489?
CVE-2026-33489 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33489?
Check the references section above for vendor advisories and patch information. Affected products include: Coredns.Io Coredns.