-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 21 Jul 2026 15:09:54 +0200
Source: bind9
Architecture: source
Version: 1:9.20.26-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian DNS Team <team+dns@tracker.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Changes:
bind9 (1:9.20.26-1~deb13u1) trixie-security; urgency=high
.
* New upstream version 9.20.26
+ [CVE-2026-10723]: Correct verification of NSEC3 signer name.
+ [CVE-2026-10822]: Malformed DNSKEY records could trigger an
assertion.
+ [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns
too-long name.
+ [CVE-2026-11605]: Prevent excessive validation work from crafted
negative responses.
+ [CVE-2026-11622]: Prevent cache exhaustion under sustained attack.
+ [CVE-2026-11721]: Stop accepting invalid signed wildcard records.
+ [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME
queries.
+ [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response.
+ [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC
Next Field.
Checksums-Sha1:
ec5a046277954de2875b9155aa29db816b1fcba9 2953 bind9_9.20.26-1~deb13u1.dsc
9d323db5f1d6f3c4485ba916c746c58a56a7b002 5918032 bind9_9.20.26.orig.tar.xz
c42f69f64358dbc2295d0c0cf2c12b6be417e42d 62424 bind9_9.20.26-1~deb13u1.debian.tar.xz
ab5240e9a0191330584bbf7349c4e78f1b250734 15038 bind9_9.20.26-1~deb13u1_amd64.buildinfo
Checksums-Sha256:
b10b99ce94a98395328da4a7b66954fb90dfe71a6355b01cb0749e9d6af73eba 2953 bind9_9.20.26-1~deb13u1.dsc
55248def0f870c4c46b3de72978ea972615131516663188a4564dca1d20bf350 5918032 bind9_9.20.26.orig.tar.xz
abbd2aa72a67d631d9d9fb8f6af15872a1ee7b5f1ef04018242ca5be4d174997 62424 bind9_9.20.26-1~deb13u1.debian.tar.xz
894caf91a569453563fe52e81923dc5b939a4da41e45205ffb2efee515ea9eba 15038 bind9_9.20.26-1~deb13u1_amd64.buildinfo
Files:
7d1a8c5436b7db80b654f4d75d54cca1 2953 net optional bind9_9.20.26-1~deb13u1.dsc
5068ac935059607d485625f80c233568 5918032 net optional bind9_9.20.26.orig.tar.xz
347a1418e7162c8f02574faef6dc7dcd 62424 net optional bind9_9.20.26-1~deb13u1.debian.tar.xz
c99e6df6ba48961aa9316bf99487bfa9 15038 net optional bind9_9.20.26-1~deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmpfcRZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcLYBhAAidhcPysuyXFdn8a927FLcFFh9kknhD5w+rvqi0vX2RDBw35oCEkzNxSN
Avb4bVVYUIWm97rvveFd9W/aPKzb0ahjsY8OY33xYuanDj5anmu5gOWl4dx5SJZ3
1YJCDrfSrvLKCsiNxz+u7leTBYuwXEuhhRt+T+qTq6qP4puAfeVgo27Q7FhWRm+9
5UP4Wh7+kQ4fF6NshWgZ8O/wA+6S3UfOPdi1Uiga39ooSyW8tA0iIGGjhj/PqZ/R
3kKUkx2pzJWO66BrylGQnV43dD7RNSt2I25VCoxIGWJooHO6JiXlzXUbwVVwWVkP
nP2OkJpeoTD4whIAR1laelnnh1/L1VBKq3YTaiY0/msP47LeZuZZz8oAXgaVt6iB
vEY8102Y1AJCdvXdWJcBpEYC5dCU/SjejlXE2ovgth25X8DIwOCXZJDUSZQ/YvOO
4g3BBYiztGC8RvE8xx3ARJcCW6C+y8I7M7RqIRA1jj3A7A65Iy8wbrsz9yi5lxr7
SHYe3A6uAMSoH1oV3jmdOg+ND9r6NrGXIzr0zOmuD2YzT454CQmjsnmNw2PCs/6F
UQTLZ1HTjHdxYMKy/+iTNvpfXuYcqSrEsOfcdfNqXyjW2DFKRFRGC4Rckq6esilA
VBAAREv7kjL9sz7DOBNG7UbRk6P1soea2pBBZS4nMJDtbcdoDzE=
=q8On
-----END PGP SIGNATURE-----
