openSUSE security update: security update for coredns
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:21674-1
Rating: moderate
References:
* bsc#1276712
Cross-References:
* CVE-2026-41178
CVSS scores:
* CVE-2026-41178 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has one bug fix can now be installed.
Description:
This update for coredns fixes the following issues:
Changes in coredns:
- Update to version 1.14.7:
* plugin/acl, plugin/cache, plugin/file, plugin/forward, plugin/kubernetes:
assorted correctness fixes (stale-cache races, AXFR zone contamination,
DoH health-check TLS config, failover counter reset, ACL bypass via
autopath).
* New: plugin/shed (UDP overload protection), plugin/tls (ACME DNS-01),
plugin/timeouts maxtcpqueries, DoQ connection-level concurrency limits.
- CVE-2026-41178: go.opentelemetry.io/otel/baggage header parsing did not
reject excessively large raw values, allowing a denial of service via
oversized input; fixed by the otel bump to v1.44.0 pulled in with
this update (boo#1276712)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-packagehub-543=1
Package List:
- openSUSE Leap 16.0:
coredns-1.14.7-bp160.1.1
coredns-extras-1.14.7-bp160.1.1
References:
* https://www.suse.com/security/cve/CVE-2026-41178.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.