THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-9gm5-9rfh-m6vx (high) — CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

[GHSA] GHSA-9gm5-9rfh-m6vx (high) — CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

highgithub_advisoriesPublished 2026-09-17

GHSA-9gm5-9rfh-m6vx Severity: high CVE: CVE-2026-86003

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

### Summary

CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the `proxy`/`forward` plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode

MITRE ATT&CK techniques

DNS ServerT1583.002
DNS ServerT1584.002
CompressionT1027.015

Indicators of compromise

18a58b9e898ccd95c3f8ee72a37b95b3d1e3e928sha1
530b0a5ff2ad68cc0421f10dd93568945cc671c9sha1
d5e54040ffab9a5c12c6de27b66f59f62b385195sha1
CVE-2026-86003cve
https://.:8053url
192.0.2.123ipv4

Original source: https://github.com/advisories/GHSA-9gm5-9rfh-m6vx