HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-33489 — CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tr...

·Source: NIST NVD

Updated:

Executive Summary

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone

Analysis

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3. CVSS Score: 7.5. Published: 2026-05-05T20:16:36.627.

Indicators of Compromise (3)

CVE (1)
CVE-2026-33489
NVDMITRE CVE
Domain (2)
example.org
VirusTotalURLhaus
a.example.org
VirusTotalURLhaus
Source Attribution

Originally published by NIST NVD on May 5, 2026. Verified by: NIST.

Related Threats

CRITICALAi

Patch Tuesday - May 2026

Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday . Microsoft is not aware of exploitation in the wild or public disclosure for any of these vulnerabilities. So far this month, Microsoft has provided patches to address 133 browser vulnerabilities, which are not included in the Patch Tuesday count above. Windows Netlogon: critical RCE Anyone responsible for securing a domain con

CVE-2026-41089CVE-2020-1472
Rapid7
LOWVulnerabilityNEW

CIOs and HR Leaders Must Redesign Work for AI

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cios-hr-leaders-must-redesign-work-for-ai-image_small-4-a-33254.jpg" align=right hspace=4><b>Survey: Organizations Must Clarify Accountability as Leadership Roles Shift</b><br>AI is changing how work is divided and decisions are made, while many organizations still haven't clarified who owns AI-related choices and outcomes. CIOs c

Bank Info Security
CRITICALVulnerability

Critical UEFI Flaw Exposes Systems to Pre-Boot Attacks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/critical-uefi-flaw-exposes-systems-to-pre-boot-attacks-image_small-3-a-33252.jpg" align=right hspace=4><b>Attackers Can Exploit ICMP Error Handling Before Operating System Protections Load</b><br>A critical buffer overflow in TianoCore's EDK II UEFI firmware, tracked as CVE-2026-97631, could let unauthenticated attackers execute c

CVE-2026-97631
Bank Info Security