This update for coredns fixes the following issues: Update to version 1.14.2: - CVE-2026-26017: Fixed DNS access control bypass due to default execution order of plugins and TOCTOU flaw (bsc#1259320). - CVE-2026-26018: Fixed denial of service in the loop detection plugin due to predictable PRNG combined with fatal error handler (bsc#1259319). - CVE-2025-68156: Fixed uncontrolled recursion in expression evaluation can cause a denial of service (bsc#1255345).
Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-80=1
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-80=1
- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le x86_64): coredns-1.14.2-bp157.2.13.1 - openSUSE Backports SLE-15-SP7 (noarch): coredns-extras-1.14.2-bp157.2.13.1
- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le x86_64):
coredns-1.14.2-bp157.2.13.1
- openSUSE Backports SLE-15-SP7 (noarch):
coredns-extras-1.14.2-bp157.2.13.1
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
