This release adds 5 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryFixed several edge‑case bugs in DNS response handling and added robustness improvements across core components.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Use Go TLS defaults for DNS transport security. Use Go TLS defaults for DNS transport security. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Add DoH support to the forward plugin for HTTPS DNS forwarding. Add DoH support to the forward plugin for HTTPS DNS forwarding. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Make per‑upstream read timeout configurable in the forward plugin. Make per‑upstream read timeout configurable in the forward plugin. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Add wildcard support to the hosts plugin for pattern‑based host resolution. Add wildcard support to the hosts plugin for pattern‑based host resolution. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Add Config.UDPDecorateWriterFunc to core for external plugin customization. Add Config.UDPDecorateWriterFunc to core for external plugin customization. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Accept scoped IPv6 addresses in transfer targets. Accept scoped IPv6 addresses in transfer targets. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Propagate HTTPRequestValidateFunc to all configs in a server block. Propagate HTTPRequestValidateFunc to all configs in a server block. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Store IPv4‑mapped IPv6 addresses as 4 octets with SocketFamily INET in dnstap plugin. Store IPv4‑mapped IPv6 addresses as 4 octets with SocketFamily INET in dnstap plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Apply default truncate amount of 2 for bare `truncate` in erratic plugin. Apply default truncate amount of 2 for bare `truncate` in erratic plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Run additional processing for wildcard answers in file plugin. Run additional processing for wildcard answers in file plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream in forward plugin. Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream in forward plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Handle names under .localhost. in local plugin. Handle names under .localhost. in local plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Restore the original question on empty replies in rewrite plugin. Restore the original question on empty replies in rewrite plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Performance | Low |
Bound DoQ stream read with the server read timeout. Bound DoQ stream read with the server read timeout. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Medium |
Guard Join against an empty label slice to avoid panics. Guard Join against an empty label slice to avoid panics. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fix self‑deadlock in dnstap listener broadcast on client flush error. Fix self‑deadlock in dnstap listener broadcast on client flush error. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fix nil‑pointer panic in rewrite plugin's EDNS0 response reversion with no OPT record. Fix nil‑pointer panic in rewrite plugin's EDNS0 response reversion with no OPT record. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fix AXFR panic in kubernetes plugin when nsAddrs returns multiple records. Fix AXFR panic in kubernetes plugin when nsAddrs returns multiple records. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fix data race between lookups and reload in hosts plugin. Fix data race between lookups and reload in hosts plugin. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Sanitize DoH/DoH3 request parse errors to prevent crashes. Sanitize DoH/DoH3 request parse errors to prevent crashes. Source: llm_adapter@2026-07-16 Confidence: low |
— |
| Bugfix | Low |
Classify NXDOMAIN without SOA as denial. Classify NXDOMAIN without SOA as denial. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Warn on duplicate zone file origins in auto plugin. Warn on duplicate zone file origins in auto plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Close previous connection before reconnecting in dnstap plugin. Close previous connection before reconnecting in dnstap plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Return SOA in authority for negative CNAME target answers in file plugin. Return SOA in authority for negative CNAME target answers in file plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Restore old behavior of forward plugin continuing on empty config file. Restore old behavior of forward plugin continuing on empty config file. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Fall through unsupported query types in hosts plugin. Fall through unsupported query types in hosts plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Synthesize deferred error responses in log plugin. Synthesize deferred error responses in log plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Parse catalog zones after transfer in secondary plugin. Parse catalog zones after transfer in secondary plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Stop update loop on reload shutdown in secondary plugin. Stop update loop on reload shutdown in secondary plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Refactor | Low |
Add regression test for AD bit not partitioning the cache in dnstap plugin. Add regression test for AD bit not partitioning the cache in dnstap plugin. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
This release improves DNS transport security and operational reliability, with
safer DoH/DoH3 handling, enhanced forwarding configuration, and improved dnstap
support. It also adds robustness improvements across file serving, secondary
zones, transfers, rewrites, hosts handling, and error processing, while fixing
several edge cases in DNS response handling.
Brought to You By
Aaron Mark
Amirhossein Ebrahimzade
Antoine
Baltasar Blanco
Cedric Wang
Ilya Kulakov
Immanuel Tikhonov
Jaime Hablutzel
Jonathan Tooker
Omkhar Arasaratnam
Pavel Lazureykis
SEONGHYUN HONG
Saleh
Thomas Gosteli
Ville Vesilehto
Yong Tang
houyuwushang
rpb-ant
Noteworthy Changes
core: Accept scoped IPv6 addresses in transfer targets (https://github.com/coredns/coredns/pull/8204)
core: Bound DoQ stream read with the server read timeout (https://github.com/coredns/coredns/pull/8231)
core: Classify nxdomain without soa as denial (https://github.com/coredns/coredns/pull/8199)
core: Guard Join against an empty label slice (https://github.com/coredns/coredns/pull/8225)
core: Propagate HTTPRequestValidateFunc to all configs in a server block (https://github.com/coredns/coredns/pull/8169)
core: Sanitize DoH/DoH3 request parse errors (https://github.com/coredns/coredns/pull/8254)
core: Use Go TLS defaults (https://github.com/coredns/coredns/pull/8227)
core: Add Config.UDPDecorateWriterFunc for external plugins (https://github.com/coredns/coredns/pull/8257)
plugin/auto: Warn on duplicate zone file origins (https://github.com/coredns/coredns/pull/8191)
plugin/cache: Add regression test for AD bit not partitioning the cache (https://github.com/coredns/coredns/pull/8214)
plugin/dnstap: Close the previous connection before reconnecting (https://github.com/coredns/coredns/pull/8224)
plugin/dnstap: Fix self-deadlock in listener broadcast on client flush error (https://github.com/coredns/coredns/pull/8260)
plugin/dnstap: Store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET (https://github.com/coredns/coredns/pull/8186)
plugin/erratic: Apply default truncate amount of 2 for bare truncate (https://github.com/coredns/coredns/pull/8240)
plugin/file: Return SOA in authority for negative CNAME target answers (https://github.com/coredns/coredns/pull/8226)
plugin/file: Run additional processing for wildcard answers (https://github.com/coredns/coredns/pull/8222)
plugin/forward: Add doh support (https://github.com/coredns/coredns/pull/8004)
plugin/forward: Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream (https://github.com/coredns/coredns/pull/8184)
plugin/forward: Make per-upstream read timeout configurable (https://github.com/coredns/coredns/pull/8205)
plugin/forward: Restore old behavior forward plugin continue on empty conf file (https://github.com/coredns/coredns/pull/8203)
plugin/hosts: Add wildcard support (https://github.com/coredns/coredns/pull/8185)
plugin/hosts: Fall through unsupported query types (https://github.com/coredns/coredns/pull/8193)
plugin/hosts: Fix data race between lookups and reload (https://github.com/coredns/coredns/pull/8253)
plugin/kubernetes: Fix AXFR panic when nsAddrs returns multiple records (https://github.com/coredns/coredns/pull/8256)
plugin/local: Handle names under .localhost. (https://github.com/coredns/coredns/pull/8151)
plugin/log: Synthesize deferred error responses (https://github.com/coredns/coredns/pull/8200)
plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record (https://github.com/coredns/coredns/pull/8190)
plugin/rewrite: Restore the original question on empty replies (https://github.com/coredns/coredns/pull/8212)
plugin/secondary: Parse catalog zones after transfer (https://github.com/coredns/coredns/pull/8209)
plugin/secondary: Stop update loop on reload shutdown (https://github.com/coredns/coredns/pull/8198)
plugin/trace: Correct Zipkin v2 endpoint docs (https://github.com/coredns/coredns/pull/8202)
plugin/transfer: Configure notify source address (https://github.com/coredns/coredns/pull/8192)
plugin/transfer: Fix panic in CoreDNS transfer plugin caused by empty DNS record (https://github.com/coredns/coredns/pull/8207)
plugin/tsig: Don't echo client's TSIG.Error if verification is successful (https://github.com/coredns/coredns/pull/8215)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]