# CVE-2025-58063: CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion CVE-2025-58063 is fixed in 2 products on 1 platform, first by SUSE-SU-2025:03289-1, released September 22, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-58063 - Priority: High - CVSS: 7.1 - EPSS: 0.0051 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 11, 2025 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-58063 ## Description This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20250918T182144 2025-09-18T18:21:44Z (jsc#PED-11136). Go CVE Numbering Authority IDs added or updated with aliases: * GO-2025-3915 CVE-2025-5187 GHSA-4x4m-3c2p-qppc * GO-2025-3956 CVE-2025-47906 CVE-2025-47906 - Update to version 0.0.20250917T170349 2025-09-17T17:03:49Z (jsc#PED-11136). Go CVE Numbering Authority IDs added or updated with aliases: * GO-2025-3922 CVE-2025-58058 GHSA-jc7w-c686-c4v9 * GO-2025-3926 CVE-2025-58158 GHSA-w469-hj2f-jpr5 * GO-2025-3929 CVE-2025-58157 GHSA-9fvj-xqr2-xwg8 * GO-2025-3938 CVE-2025-58437 GHSA-j6xf-jwrj-v5qp * GO-2025-3939 CVE-2025-7445 GHSA-rcw7-pqfp-735x * GO-2025-3940 CVE-2025-58445 GHSA-xh7v-965r-23f7 * GO-2025-3941 CVE-2025-58450 GHSA-p46v-f2x8-qp98 * GO-2025-3942 CVE-2025-58063 GHSA-93mf-426m-g6x9 * GO-2025-3943 CVE-2025-58430 GHSA-rf24-wg77-gq7w * GO-2025-3944 CVE-2025-54123 GHSA-r4h8-hfp2-ggmf * GO-2025-3945 CVE-2025-54376 GHSA-jxmr-2h4q-rhxp * GO-2025-3949 CVE-2025-59361 GHSA-2gcv-3qpf-c5qr * GO-2025-3950 CVE-2025-9076 GHSA-3vcm-c42p-3hhf * GO-2025-3951 CVE-2025-59358 GHSA-2gg8-85m5-8r2p * GO-2025-3952 CVE-2025-59359 GHSA-369h-6j28-wwcg * GO-2025-3953 CVE-2025-8396 GHSA-p768-c3pr-6459 * GO-2025-3954 CVE-2025-59360 GHSA-xv9f-728h-9jgv * GO-2025-3958 CVE-2025-9072 GHSA-69j8-prx2-vx98 * GO-2025-3959 CVE-2025-9078 GHSA-9p92-x77w-9fw2 * GO-2025-3960 CVE-2025-9084 GHSA-hm95-jx66-g2gh * GO-2025-3961 CVE-2025-4953 GHSA-m68q-4hqr-mc6f - Update to version 0.0.20250908T141310 2025-09-08T14:13:10Z (jsc#PED-11136). Go CVE Numbering Authority IDs added or updated with aliases: * GO-2025-3916 CVE-2025-51667 GHSA-f2m2-4q6r-cwc4 * GO-2025-3917 CVE-2025-53884 GHSA-8ff6-pc43-jwv3 * GO-2025-3918 CVE-2025-8077 GHSA-8pxw-9c75-6w56 * GO-2025-3919 CVE-2025-54467 GHSA-w54x-xfxg-4gxq * GO-2025-3920 GHSA-vxg3-w9rv-rhr2 * GO-2025-3921 GHSA-3rw9-wmc8-8948 * GO-2025-3923 CVE-2024-58259 GHSA-4h45-jpvh-6p5j * GO-2025-3924 CVE-2025-6203 GHSA-8f82-53h8-2p34 * GO-2025-3925 GHSA-v2ch-c8v8-fgr7 * GO-2025-3927 CVE-2024-52284 GHSA-6h9x-9j5v-7w9h * GO-2025-3930 CVE-2025-58355 GHSA-33pr-m977-5w97 * GO-2025-3934 CVE-2025-55190 GHSA-786q-9hcg-v9ff * GO-2025-3935 CVE-2025-9566 GHSA-wp3j-xq48-xpjw * GO-2025-3936 CVE-2025-56760 GHSA-78j5-8vq7-jxv5 * GO-2025-3937 CVE-2025-56761 GHSA-cgrg-86m5-xm4w ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | coredns opensuse-leap 16.0 | 1.14.0-bp160.1.1 | [OPENSUSE-SU-2026:20099-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20099-1.md) | Jan 24, 2026 | | Linux | govulncheck-vulndb opensuse-leap 15.6 | 0.0.20250918T182144-150000.1.107.1 | [SUSE-SU-2025:03289-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03289-1.md) | Sep 22, 2025 | | Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 | | Linux | govulncheck-vulndb sles 15.6 | 0.0.20250918T182144-150000.1.107.1 | [SUSE-SU-2025:03289-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03289-1.md) | Sep 22, 2025 | --- Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.