Threats tagged 'ghsa-h8mm-c463-wjq3'

CoreDNS versions prior to 1.14.3 contain a vulnerability in the transfer plugin where the selection of ACL stanzas for zone transfers uses lexicographic comparison instead of longest zone match. This flaw allows a permissive parent zone transfer rule to override a more restrictive subzone rule, enabling unauthorized clients to perform zone transfers (AXFR/IXFR) on subzones that should be restricted. The issue is fixed in version 1.14.3.