CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) in github.com/coredns/coredns
{ "url": "https://pkg.go.dev/vuln/GO-2026-5417", "review_status": "UNREVIEWED" }
"https://vuln.go.dev/ID/GO-2026-5417.json"