CVE-2026-35579: CoreDNS is a DNS server written in Go

Q: How do I fix CVE-2026-35579?

coredns: upgrade to 1.14.3. Exact commands for each OS are on this page.

Q: Is CVE-2026-35579 being exploited?

CVE-2026-35579 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-35579 affect?

CVE-2026-35579 affects coredns. Severity is critical (CVSS 9.8). CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the

Q: How urgent is CVE-2026-35579?

Priority 57/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2026-35579 is a critical-severity flaw (CVSS 9.8) affecting coredns. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configuration but never calls dns.TsigVerify() to validate the HMAC. If the key name matches a configured key, the tsigStatus field remains nil and the tsig plugin treats the request as successfully authentica

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.6% (top 51%)
CISA exploited list	No
Weakness	CWE-287, CWE-303
Published	2026-05-05
Last modified	2026-07-24

Publisher (CNA): GitHub, Inc. · Vendor: coredns.io

Last updated 2026-07-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-05-05 21:16 UTCPublished CVE record published
2026-07-24 21:10 UTCUpdated Record last modified

coredns.io coredns UPGRADE

Affected: < 1.14.3

Fixed in: 1.14.3

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy coredns || rpm -q coredns || coredns --version

2. UPGRADE to 1.14.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade coredns

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade coredns

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Go · github.com/coredns/coredns · FIXED · 1.14.3 · vulnerable: < 1.14.3 · source

go get github.com/coredns/coredns@v1.14.3 go list -m github.com/coredns/coredns

Fedora 46 · fzssh · FIXED · 1.4.0-2.fc46 · FEDORA-2026-8004fcd067 · source

sudo dnf upgrade --advisory=FEDORA-2026-8004fcd067

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: github.com/coredns/coredns/security/advisories/GHSA-vp29-5652-4fw9

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-35579?

coredns: upgrade to 1.14.3. Exact commands for each OS are on this page.

Is CVE-2026-35579 being exploited?

CVE-2026-35579 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-35579 affect?

CVE-2026-35579 affects coredns. Severity is critical (CVSS 9.8). CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the

How urgent is CVE-2026-35579?

Priority 57/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-32936 HIGH 7.5 UPGRADE CoreDNS is a DNS server that chains plugins
CVE-2026-32934 HIGH 7.5 UPGRADE CoreDNS is a DNS server that chains plugins
CVE-2026-33489 HIGH 7.5 UPGRADE CoreDNS is a DNS server that chains plugins
CVE-2026-33190 HIGH 7.5 UPGRADE CoreDNS is a DNS server that chains plugins
CVE-2026-62299 MEDIUM 5.3 UPGRADE CoreDNS is a DNS server written in Go

References

← Back to latest CVEs