Back Linuxsecurity

openSUSE 15 SP6 Coredns Important Access Control Fix 2026-0079

Linuxsecurity •LinuxSecurity Advisories • March 11, 2026

This update for coredns fixes the following issues: Update to version 1.14.2: - CVE-2026-26017: Fixed DNS access control bypass due to default execution order of plugins and TOCTOU flaw (bsc#1259320). - CVE-2026-26018: Fixed denial of service in the loop detection plugin due to predictable PRNG combined with fatal error handler (bsc#1259319). Update to version 1.14.1: - This release primarily addresses security vulnerabilities affecting Go versions prior to Go 1.25.6 and Go 1.24.12 (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731, CVE-2025-68119). - CVE-2025-68156: Fixed uncontrolled recursion in expression evaluation can cause a denial of service (bsc#1255345).

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2026-79=1

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP6:

zypper in -t patch openSUSE-2026-79=1

- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64): coredns-1.14.2-bp156.4.16.1 - openSUSE Backports SLE-15-SP6 (noarch): coredns-extras-1.14.2-bp156.4.16.1

- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64):

coredns-1.14.2-bp156.4.16.1

- openSUSE Backports SLE-15-SP6 (noarch):

coredns-extras-1.14.2-bp156.4.16.1

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Access Control and DoS Vulnerabilities in CoreDNS Addressed Recent updates for CoreDNS have addressed significant vulnerabilities affecting DNS services. The updates include fixes for CVE-2026-26017, which resolves an access control bypass due to a flaw in the execution order of plugins, and CVE-2026-26018, which mitigates a denial of service vulnerability linked to predictable pseudo-random number generation. Additionally, CVE-2025-68156 has been patched to prevent uncontrolled recursion in expression evaluation, which can also lead to denial of service. These vulnerabilities impact users of openSUSE and Fedora systems utilizing CoreDNS versions prior to the updates. The patches are available through standard installation methods like YaST and zypper. Users are advised to apply the updates promptly to secure their systems against potential exploitation. The vulnerabilities were disclosed on March 6, 2026, and the updates were released on March 11, 2026. 2 sources 58

Extracted Entities

CVEs (8)

CVE-2025-61726 CVE-2025-61728 CVE-2025-61731 CVE-2025-68119 CVE-2025-68121 CVE-2025-68156 CVE-2026-26017 CVE-2026-26018

IP Addresses (1)

156.4.16.1