diff --git a/0001-plugin-reorder-rewrite-before-acl-to-prevent-bypass.patch b/0001-plugin-reorder-rewrite-before-acl-to-prevent-bypass.patch
deleted file mode 100644
index 158e6f37dbce404cc06c5c79053a1c570d4ef9a3..0000000000000000000000000000000000000000
--- a/0001-plugin-reorder-rewrite-before-acl-to-prevent-bypass.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 0c93dd88d756ef39c59e708d60fe2939b2dbdcb9 Mon Sep 17 00:00:00 2001
-From: clarehkli <clarehkli@tencent.com>
-Date: Wed, 11 Mar 2026 17:50:09 +0800
-Subject: [PATCH] plugin: reorder rewrite before acl to prevent bypass
-
----
- plugin.cfg | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/plugin.cfg b/plugin.cfg
-index 6b3d716..9569bac 100644
---- a/plugin.cfg
-+++ b/plugin.cfg
-@@ -42,13 +42,13 @@ log:log
- dnstap:dnstap
- local:local
- dns64:dns64
--acl:acl
- any:any
- chaos:chaos
- loadbalance:loadbalance
- tsig:tsig
- cache:cache
- rewrite:rewrite
-+acl:acl
- header:header
- dnssec:dnssec
- autopath:autopath
--- 
-2.43.7
-
diff --git a/0001-update-expr-to-v1.17.7-to-fix-CVE-2025-68156.patch b/0001-update-expr-to-v1.17.7-to-fix-CVE-2025-68156.patch
deleted file mode 100644
index f6fe00fa2e159804a5923941ff76b6cdbccd4968..0000000000000000000000000000000000000000
--- a/0001-update-expr-to-v1.17.7-to-fix-CVE-2025-68156.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 7081e9125abb8eca2a04ccc3d83fffcef2bded25 Mon Sep 17 00:00:00 2001
-From: clarehkli <clarehkli@tencent.com>
-Date: Mon, 29 Dec 2025 14:01:51 +0800
-Subject: [PATCH] update expr to v1.17.7 to fix CVE-2025-68156
-
----
- go.mod | 2 +-
- go.sum | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/go.mod b/go.mod
-index 781e236..829ba32 100644
---- a/go.mod
-+++ b/go.mod
-@@ -18,7 +18,7 @@ require (
- 	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.2
- 	github.com/coredns/caddy v1.1.2-0.20241029205200-8de985351a98
- 	github.com/dnstap/golang-dnstap v0.4.0
--	github.com/expr-lang/expr v1.17.6
-+	github.com/expr-lang/expr v1.17.7
- 	github.com/farsightsec/golang-framestream v0.3.0
- 	github.com/go-logr/logr v1.4.3
- 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645
-diff --git a/go.sum b/go.sum
-index 770d0bc..7943a89 100644
---- a/go.sum
-+++ b/go.sum
-@@ -136,8 +136,8 @@ github.com/ebitengine/purego v0.8.3 h1:K+0AjQp63JEZTEMZiwsI9g0+hAMNohwUOtY0RPGex
- github.com/ebitengine/purego v0.8.3/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
- github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
- github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
--github.com/expr-lang/expr v1.17.6 h1:1h6i8ONk9cexhDmowO/A64VPxHScu7qfSl2k8OlINec=
--github.com/expr-lang/expr v1.17.6/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
-+github.com/expr-lang/expr v1.17.7 h1:Q0xY/e/2aCIp8g9s/LGvMDCC5PxYlvHgDZRQ4y16JX8=
-+github.com/expr-lang/expr v1.17.7/go.mod h1:8/vRC7+7HBzESEqt5kKpYXxrxkr31SaO8r40VO/1IT4=
- github.com/farsightsec/golang-framestream v0.3.0 h1:/spFQHucTle/ZIPkYqrfshQqPe2VQEzesH243TjIwqA=
- github.com/farsightsec/golang-framestream v0.3.0/go.mod h1:eNde4IQyEiA5br02AouhEHCu3p3UzrCdFR4LuQHklMI=
- github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
--- 
-2.43.7
-
diff --git a/coredns.spec b/coredns.spec
index ef8331b800ca72aa0807deaeaa0f2567443bfde1..f6ea7c0bc67bfc364d32204646ee53be5f54b97c 100644
--- a/coredns.spec
+++ b/coredns.spec
@@ -3,8 +3,8 @@
 
 Summary:        DNS server written in Go
 Name:           coredns
-Version:        1.12.4
-Release:        3%{?dist}
+Version:        1.14.3
+Release:        1%{?dist}
 License:        Apache-2.0
 URL:            https://coredns.io
 Source0:        https://%{goipath}/archive/v%{version}/%{name}-%{version}.tar.gz
@@ -13,9 +13,6 @@ Source1:        coredns-%{version}-vendor.tar.gz
 Source2:        Corefile
 Source3:        coredns.service
 
-Patch5000:      0001-update-expr-to-v1.17.7-to-fix-CVE-2025-68156.patch
-Patch5001:      0001-plugin-reorder-rewrite-before-acl-to-prevent-bypass.patch
-
 BuildRequires:  fdupes golang >= 1.20 go-rpm-macros
 Provides:       dns_daemon
 
@@ -88,6 +85,10 @@ install -pm 0644 man/coredns-*.7 %{buildroot}/%{_mandir}/man7
 %{_mandir}/man7/coredns-*
 
 %changelog
+* Tue Jul 14 2026 clarehkli <clarehkli@tencent.com> - 1.14.3-1
+- [Type] security
+- [DESC] upgrade to 1.14.3 to fix CVE-2025-68151
+
 * Wed Mar 11 2026 clarehkli <clarehkli@tencent.com> - 1.12.4-3
 - [Type] security
 - [DESC] backport upstream patch to fix CVE-2026-26017
diff --git a/sources b/sources
index 360b164273c3a4a247bb700605765ba598d267a5..0cc5c084a25c900846977bfc0c3e5a07ba023bfa 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (coredns-1.12.4.tar.gz) = 7bf233d5e122105417467009ea72405ec566993570138f5c32afbbb42e9f977ee57e2f0abd3e96c58e1718c7c181cc54c8ce7f8e04de5e2c5100771be1570528
-SHA512 (coredns-1.12.4-vendor.tar.gz) = f4227fdf0d8c2caac2dd3175d5bc2b2466f259d4cae319fd44ca0247f29c58bf26ea7d7a6d7c0fc104c03b2a3aab86376a162c5c2c918cfd17e2baaaa16364da
+SHA512 (coredns-1.14.3.tar.gz) = 39b87ff29460e8eb2fd9db53ae6fe19d7b7c99da0a7cfc9e93b22d93c2c53c5cfd2bb493610901a6cfae578430d1fc215b9c9d70e95cc31f0c4084b618e60864
+SHA512 (coredns-1.14.3-vendor.tar.gz) = 5ce920f74576c423cc896ccd98f2e2f3c1aa6c9443acc9049e360ec388ea2c2ca6354c7f8f5bc29faba2d218dc2e0adb160aca0963d90e1307a5cf1503c134e6