Wnoelll

**Name of the Vulnerable Software and Affected Versions** CoreDNS versions prior to 1.14.3 **Description** Incorrect handling of TSIG (Transaction Signature) authentication in gRPC, QUIC, DoH (DNS over HTTPS), and DoH3 transport implementations allows an unauthenticated network attacker to bypass security protections. This can lead to unauthorized access to restricted functionalities, including AXFR/IXFR zone transfers and dynamic DNS updates. Technical details include: - For gRPC and QUIC, the server verifies the TSIG key name but fails to call the `dns.TsigVerify()` function to validate the HMAC. If the key name is valid, the `tsigStatus` variable remains nil, leading the system to treat the request as authenticated regardless of the MAC value. - For DoH and DoH3, the `DoHWriter.TsigStatus()` function unconditionally returns nil, and the server does not inspect the TSIG record. Consequently, any request containing a TSIG record is treated as authenticated, even with an invalid key name or arbitrary MAC. **Recommendations** Update CoreDNS to version 1.14.3. As a temporary workaround, disable gRPC, QUIC, DoH, and DoH3 listeners where TSIG authentication is required. Restrict network-level access to the affected transport ports to trusted sources only.