StackRadar

CVE-2026-32936

High

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
73
of 17,781 indexed, latest versions
Container images
61
deployed by those charts
Fix available
1 of 1
affected package

CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification

Carried by container images the latest versions of 73 of 17,781 indexed charts deploy, on 61 images.

Affected packageAffected versionsFixed inImages
github.com/coredns/corednsgolangv0.0.0-20200803163833-7d5f5b87a4fb, v0.0.0-20230206182419-055b2c31a9cf, v0.0.0-20241121192733-51e11f166ef6, v0.0.0-20251008152637-1db4568df6aa+17 more1.14.361
OSV records
GHSA-63cw-r7xf-jmwr
Also known as
GO-2026-5164

Charts affected

73 by stars
ChartLatestAffected imagesRadar Score
corednscorednsVerified publisher1.47.11 of 1See more

coredns coredns 1.47.1

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
coredns/coredns:1.14.6900f9c109f7a
github.com/coredns/coredns@v0.0.0-20260710050435-424d125775cd
1.14.3

Open the chart page →

330
chaos-meshchaos-meshVerified publisher2.8.41 of 4See more

chaos-mesh chaos-mesh 2.8.4

1 of the 4 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-coredns:v0.2.838bfdf5e3774
github.com/coredns/coredns@v1.7.1-0.20200803163833-7d5f5b87a4fb+dirty
1.14.3

Open the chart page →

6,342
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-03-20T20-16-18Z6d770d7f255c
github.com/coredns/coredns@v1.10.1
1.14.3

Open the chart page →

32,259
node-local-dnsdeliveryheroVerified publisher2.9.21 of 1See more

node-local-dns deliveryhero 2.9.2

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
github.com/coredns/coredns@v1.13.1
1.14.3

Open the chart page →

1,685
glasskube-operatorglasskubeOfficialVerified publisher0.12.21 of 3See more

glasskube-operator glasskube 0.12.2

1 of the 3 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
github.com/coredns/coredns@v1.11.1
1.14.3

Open the chart page →

11,933
uptime-kumaduyet0.1.71 of 1See more

uptime-kuma duyet 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
github.com/coredns/coredns@v1.8.7
1.14.3

Open the chart page →

4,515
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2024.7.4-debian-12-r0952f86d1116c
github.com/coredns/coredns@v1.11.3
1.14.3

Open the chart page →

17,263
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2024.8.3-debian-12-r15501c419f42e
github.com/coredns/coredns@v1.11.3
1.14.3

Open the chart page →

27,267
node-local-dnsnode-local-dns2.4.01 of 1See more

node-local-dns node-local-dns 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
registry.k8s.io/dns/k8s-dns-node-cache:1.23.081a13703d6b8
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

2,593
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/coredns/coredns@v1.9.4
1.14.3

Open the chart page →

24,700
kraken-cikraken-ciVerified publisher1.7.361 of 10See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-10-24T18-35-07Zf9576903f19d
github.com/coredns/coredns@v1.9.4
1.14.3

Open the chart page →

7,273
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2020-12-03T05-49-24Z053f103f4894
github.com/coredns/coredns@v1.4.0
1.14.3

Open the chart page →

107,811
corednssoftizyVerified publisher0.2.01 of 1See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
coredns/coredns:1.10.1a0ead06651cf
github.com/coredns/coredns@v0.0.0-20230206182419-055b2c31a9cf
1.14.3

Open the chart page →

1,663
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.23-debian-11-r25bb0aa825d16
github.com/coredns/coredns@v1.11.1
1.14.3

Open the chart page →

28,534
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
github.com/coredns/coredns@v1.8.7
1.14.3

Open the chart page →

5,079
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

4,196
juicefskubesphere-stable0.16.21 of 4See more

juicefs kubesphere-stable 0.16.2

1 of the 4 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.20.043978fc60798
github.com/coredns/coredns@v1.6.6
1.14.3

Open the chart page →

2,489
lgtm-stacklgtm-stackVerified publisher0.1.31 of 8See more

lgtm-stack lgtm-stack 0.1.3

1 of the 8 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2024-01-18T22-51-28Z551682a57a94
github.com/coredns/coredns@v1.11.1
1.14.3

Open the chart page →

5,576
miniomilvus8.0.171 of 1See more

minio milvus 8.0.17

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
github.com/coredns/coredns@v1.4.0
1.14.3

Open the chart page →

6,915
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.230b60b6565ab2
github.com/coredns/coredns@v1.11.1
1.14.3

Open the chart page →

37,373
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
github.com/coredns/coredns@v1.12.2
1.14.3

Open the chart page →

6,883
cloudflare-tunnelrlex0.8.01 of 1See more

cloudflare-tunnel rlex 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2023.10.0c18744ae1767
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

1,684
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
github.com/coredns/coredns@v1.12.2
1.14.3

Open the chart page →

38,107
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
github.com/coredns/coredns@v1.10.1
1.14.3

Open the chart page →

10,090
airbyteairbyte-v2Verified publisher2.2.01 of 10See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-11-20T22-40-07Zb833a1699b4f
github.com/coredns/coredns@v1.11.1
1.14.3

Open the chart page →

12,473
minioappscodeVerified publisher2026.9.111 of 1See more

minio appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-01-12T02-06-16Zfc6bedc99355
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

4,043
assemblylineassemblylineVerified publisher7.4.171 of 12See more

assemblyline assemblyline 7.4.17

1 of the 12 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-01-11T07-46-16Z796f75ea413b
github.com/coredns/coredns@v1.11.1
1.14.3

Open the chart page →

12,898
ragflowbaboulinet0.1.11 of 5See more

ragflow baboulinet 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-12-20T01-00-02Z5702ea361420
github.com/coredns/coredns@v1.11.1
1.14.3

Open the chart page →

5,823
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-coredns:v0.2.838bfdf5e3774
github.com/coredns/coredns@v1.7.1-0.20200803163833-7d5f5b87a4fb+dirty
1.14.3

Open the chart page →

15,027
cloudflared-tunnelclouddrove0.1.41 of 1See more

cloudflared-tunnel clouddrove 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2025.8.0eb5c9324efe3
github.com/coredns/coredns@v1.12.2
1.14.3

Open the chart page →

1,744
miniod4nVerified publisher5.2.11 of 2See more

minio d4n 5.2.1

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2024-06-04T19-20-08Zc6b68f158628
github.com/coredns/coredns@v1.11.3
1.14.3

Open the chart page →

2,629
cloudflareddamounVerified publisher3.3.01 of 1See more

cloudflared damoun 3.3.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2024.5.05d5f70a59d5e
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

1,306
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

4,217
dnation-kubernetes-monitoring-stackdnationcloud4.0.21 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

1 of the 17 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/coredns/coredns@v1.9.4
1.14.3

Open the chart page →

21,641
corednsdoubanVerified publisher1.39.21 of 1See more

coredns douban 1.39.2

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
coredns/coredns:1.12.040384aa1f5ea
github.com/coredns/coredns@v0.0.0-20241121192733-51e11f166ef6
1.14.3

Open the chart page →

1,132
chaos-meshethereum-helm-chartsVerified publisher0.0.31 of 4See more

chaos-mesh ethereum-helm-charts 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-coredns:v0.2.678dc63bc5b89
github.com/coredns/coredns@v0.0.0-20200803163833-7d5f5b87a4fb
1.14.3

Open the chart page →

12,127
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
louislam/uptime-kuma:13d632903e6af
github.com/coredns/coredns@v1.12.2
1.14.3

Open the chart page →

3,474
mimir-openshift-experimentalgrafana2.1.01 of 4See more

mimir-openshift-experimental grafana 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
github.com/coredns/coredns@v1.4.0
1.14.3

Open the chart page →

17,759
node-local-dnshelm-charts-nr2.1.41 of 1See more

node-local-dns helm-charts-nr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
registry.k8s.io/dns/k8s-dns-node-cache:1.23.1e3dccb1a21d1
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

2,222
cac-systemhuangchengwu-helm-chart0.1.01 of 9See more

cac-system huangchengwu-helm-chart 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
huangchengwu6904/hi-app:cac-16910478061b932f8221a9
github.com/coredns/coredns@v1.6.6
1.14.3

Open the chart page →

11,186
consulintelVerified publisher0.8.11 of 2See more

consul intel 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
hashicorp/consul:1.14.2e38576edcdfd
github.com/coredns/coredns@v1.6.6
1.14.3

Open the chart page →

5,389
evi-consulintelVerified publisher3.0.31 of 2See more

evi-consul intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
hashicorp/consul:1.14.2e38576edcdfd
github.com/coredns/coredns@v1.6.6
1.14.3

Open the chart page →

5,389
evi-miniointelVerified publisher3.0.31 of 2See more

evi-minio intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

7,459
corednsjouveVerified publisher1.45.01 of 1See more

coredns jouve 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
github.com/coredns/coredns@v0.0.0-20251008152637-1db4568df6aa
1.14.3

Open the chart page →

887
miniokubebb5.0.101 of 2See more

minio kubebb 5.0.10

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
hyperledgerk8s/minio-minio:RELEASE.2023-02-10T18-48-39Zed0b0c56f1ea
github.com/coredns/coredns@v1.10.0
1.14.3

Open the chart page →

7,459
chaos-meshkubeblocksVerified publisher2.7.21 of 4See more

chaos-mesh kubeblocks 2.7.2

1 of the 4 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-coredns:v0.2.678dc63bc5b89
github.com/coredns/coredns@v0.0.0-20200803163833-7d5f5b87a4fb
1.14.3

Open the chart page →

13,497
edgemeshkubesphere-stable0.1.01 of 2See more

edgemesh kubesphere-stable 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
kubeedge/edgemesh-agent:latest460c6061b608
github.com/coredns/coredns@v1.8.0
1.14.3

Open the chart page →

4,096
vcluster-proloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
github.com/coredns/coredns@v1.10.2-0.20230607202228-6d3db023fe60
1.14.3

Open the chart page →

5,085
vcluster-pro-eksloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-eks loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
github.com/coredns/coredns@v1.10.2-0.20230607202228-6d3db023fe60
1.14.3

Open the chart page →

5,936
vcluster-pro-k0sloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2026-32936.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
github.com/coredns/coredns@v1.10.2-0.20230607202228-6d3db023fe60
1.14.3

Open the chart page →

5,768

Container images carrying it

61 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/giantswarm/cloudflared:2022.3.40b20d2fe9a6b
github.com/coredns/coredns@v1.8.7
1.14.3
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/coredns/coredns@v1.13.2
1.14.3
1
quay.io/minio/minio:RELEASE.2023-12-20T01-00-02Z5702ea361420
github.com/coredns/coredns@v1.11.1
1.14.3
1
quay.io/minio/minio:RELEASE.2024-01-11T07-46-16Z796f75ea413b
github.com/coredns/coredns@v1.11.1
1.14.3
1
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/coredns/coredns@v1.9.4
1.14.3
1
quay.io/minio/minio:RELEASE.2024-06-04T19-20-08Zc6b68f158628
github.com/coredns/coredns@v1.11.3
1.14.3
1
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/coredns/coredns@v1.9.4
1.14.3
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
github.com/coredns/coredns@v0.0.0-20251209114403-0233f3e7c600
1.14.3
1
registry.k8s.io/dns/k8s-dns-node-cache:1.23.081a13703d6b8
github.com/coredns/coredns@v1.10.0
1.14.3
1
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
github.com/coredns/coredns@v1.13.1
1.14.3
1
registry.k8s.io/dns/k8s-dns-node-cache:1.23.1e3dccb1a21d1
github.com/coredns/coredns@v1.10.0
1.14.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.