CVE-2026-33489 Details
Description
CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.
A vulnerability in CoreDNS versions prior to 1.14.3 allows for an unauthorized remote client to perform zone transfers (AXFR/IXFR) from a subzone. This occurs because the transfer plugin incorrectly selects the applicable Access Control List (ACL) rules. When both a parent zone and a more-specific subzone are present, the plugin's longestMatch() function uses lexicographic string comparison rather than the intended longest-suffix match. Consequently, a permissive transfer rule from the parent zone can override a stricter rule in the subzone, depending on the alphabetical order of the zone names. The issue has been resolved in CoreDNS version 1.14.3.
Users can upgrade to CoreDNS version 1.14.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/coredns/coredns/releases/tag/v1.14.3 | [email protected] | Release Notes |
| https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coredns.io coredns | < 1.14.3 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 5, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |