GitHub Advisoryadvisory · Go

GHSA-h92q-fgpp-qhrq CoreDNS Cache Poisoning via a birthday attack

MEDIUM Published 2024-09-18 Modified 2026-06-05 Official page ↗

Aliases: CVE-2023-30464
Ecosystem: Go
Packages: github.com/coredns/coredns
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses: CWE-290
Reviewed: 2024-09-18

Affected packages

• Go github.com/coredns/coredns: <= 1.10.1 (no fix yet)

Description

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.

Related

Alias · CVE (1)

CVE-2023-30464 CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack. vulnerability

Weakness · CWE (1)

CWE-290 Authentication Bypass by Spoofing weakness

References