openSUSE Returns With coredns Update Closing Two HTTP 2 Denial of Service Flaws
openSUSE has issued security advisory openSUSE-SU-2026:22194-1, rated important, for the coredns package on openSUSE Leap 16.0. Two CVEs are addressed: CVE-2026-78669, scored 7.5 by SUSE for excessive CPU consumption in HTTP/2, and CVE-2026-97032, scored 5.9 for an HTTP/2 server crash caused by an HPACK encoder race. Both are availability-only issues, reachable over the network without authentication or user interaction. The fixed packages are coredns and coredns-extras at version 1.15.0-bp160.1.1.
Both defects originate in the vendored golang.org/x/net library rather than in coredns code itself, and the fix comes from bumping that dependency to v0.60.0. CVE-2026-78669 is described as excessive CPU consumption triggered through HTTP/2 handling, while CVE-2026-97032 is a race condition in the HPACK encoder that crashes the server and is rated high attack complexity. The vendor has not published step-by-step exploitation details for either flaw beyond those descriptions. The same update also drops the temporary google.golang.org/grpc pin previously applied for CVE-2026-84304, because upstream now vendors grpc v1.84.0.
coredns is widely deployed as the default DNS resolver inside Kubernetes clusters and container platforms, so a sustained CPU exhaustion or process crash in that component degrades name resolution for every workload depending on it, not just the host running it. Recurring dependency-driven advisories across separate Go-based packages also show how a single upstream library defect propagates into multiple distribution packages on the same release. On current exploitation status, FIRST EPSS places CVE-2026-78669 at 0.6 percent and CVE-2026-97032 at 0.5 percent probability of exploitation within the next 30 days, with CVE-2026-84304 also at 0.6 percent. No in-the-wild exploitation has been reported for any of them.
Attack Surface
Infrastructure, Server OS, Supply Chain (Third-party vendors)
Tactics
Impact
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Install the coredns update on openSUSE Leap 16.0 with 'zypper in -t patch openSUSE-Leap-16.0-packagehub-702=1', confirming coredns and coredns-extras report version 1.15.0-bp160.1.1 afterwards.
- Inventory any other locally built or containerised Go binaries that vendor golang.org/x/net below v0.60.0, since CVE-2026-78669 and CVE-2026-97032 are fixed in that dependency rather than in coredns code.
- Verify that the temporary google.golang.org/grpc pin previously applied for CVE-2026-84304 has been removed and that builds now resolve grpc v1.84.0, as shipped in coredns 1.15.0.
- Restrict network reachability of coredns HTTP/2-capable listeners and the metrics or health endpoints to cluster-internal ranges and management subnets, rather than leaving them reachable from untrusted networks.
- Alert on coredns process restarts, panic entries in the service journal, and sustained CPU saturation of the coredns container or systemd unit, which match the crash and CPU exhaustion behaviour described for CVE-2026-97032 and CVE-2026-78669.
- Rebuild any in-house coredns packages with Go 1.26.0 or later, which is the new minimum build requirement declared for the 1.15.0 release.
- Before enabling the new coredns 1.15.0 capabilities such as DNS-over-QUIC forwarding, JSON structured logging or PROXY protocol v2 metadata, review and approve their exposure in change control instead of rolling them out with the security update.
