[Medium] Patch coredns for CVE-2025-68151#15515
Merged
LeoMar4 merged 2 commits intomicrosoft:3.0-devfrom Jan 30, 2026
Merged
Conversation
microsoft-github-policy-service
bot
added
Packaging
3.0-dev
Contributor
Contributor
Author
|
Buddy Build has passed ! |
suresh-thelkar
approved these changes
Jan 22, 2026
Contributor
suresh-thelkar
left a comment
suresh-thelkar
left a comment
There was a problem hiding this comment.
It seems all the essential security features from the upstream patch are correctly included:
- gRPC connection and stream limiting (
MaxGRPCStreams,MaxGRPCConnections) - HTTPS connection limiting (
MaxHTTPSConnections) netutil.LimitListenerusage for connection limiting- Default limits: 256 max streams, 200 max connections
- New plugins:
grpc_serverandhttps
Since the number of code changes are huge, It would be better if we can also run the full build and proceed further.
Kanishk-Bansal
added
the
ready-for-stable-review
Contributor
Contributor
Author
|
Full build has passed ! |
Contributor
|
Waiting for full build results. |
Contributor
Author
Full Build has now passed!!! CC: @kgodara912 |
LeoMar4
approved these changes
Jan 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
Patch coredns for CVE-2025-68151
Upstream patch has been backported manually.
Patch for
https3module has not been included as this module does not exist in our version of coredns.vendor/golang.org/x/net/netutil/listen.gohas been added to vendor directory and updated "module.txt" for the same.Upstream Patch Reference: https://github.com/coredns/coredns/commit/0d8cbb1a6bcb6bc9c1a489865278b8725fa20812.patch
Change Log
Does this affect the toolchain?
NO
Links to CVEs
Test Methodology
Local build was successful.
License check script shows no warning.
Build log
coredns-1.11.4-13.azl3.src.rpm.log
coredns-1.11.4-13.azl3.src.rpm.test.log
Patch applies cleanly