CVE-2026-33489

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.3

Description The transfer plugin in CoreDNS can select an incorrect Access Control List (ACL) stanza when both a parent zone and a more-specific subzone are configured. This occurs because the longestMatch() function in plugin/transfer/transfer.go employs a lexicographic string comparison rather than a true longest-suffix match to determine the winning zone. Consequently, a permissive transfer rule for a parent zone may override a restrictive rule for a subzone depending on the alphabetical ordering of the zone names. This flaw allows an unauthorized remote client to perform AXFR or IXFR (zone transfer protocols used to replicate DNS databases) for the subzone and retrieve its complete zone contents.

Recommendations Update CoreDNS to version 1.14.3 or later.