https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-62994.htmlhttps://patchthecve.com/cve/CVE-2026-62994.htmlWed, 22 Jul 2026 20:14:36 +0000LOW 3.7: CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports;https://patchthecve.com/cve/CVE-2026-62309.htmlhttps://patchthecve.com/cve/CVE-2026-62309.htmlWed, 22 Jul 2026 20:17:31 +0000HIGH 7.5: CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassighttps://patchthecve.com/cve/CVE-2026-62299.htmlhttps://patchthecve.com/cve/CVE-2026-62299.htmlWed, 22 Jul 2026 20:18:57 +0000MEDIUM 5.3: CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the re