-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 21 Jul 2026 14:43:48 +0200
Source: bind9
Architecture: source
Version: 1:9.20.26-1
Distribution: unstable
Urgency: medium
Maintainer: Debian DNS Team <team+dns@tracker.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Changes:
bind9 (1:9.20.26-1) unstable; urgency=medium
.
* New upstream version 9.20.26
+ [CVE-2026-10723]: Correct verification of NSEC3 signer name.
+ [CVE-2026-10822]: Malformed DNSKEY records could trigger an
assertion.
+ [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns
too-long name.
+ [CVE-2026-11605]: Prevent excessive validation work from crafted
negative responses.
+ [CVE-2026-11622]: Prevent cache exhaustion under sustained attack.
+ [CVE-2026-11721]: Stop accepting invalid signed wildcard records.
+ [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME
queries.
+ [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response.
+ [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC
Next Field.
Checksums-Sha1:
2e96818819108cfcb2b7b996d21aa4923f83ce1b 2910 bind9_9.20.26-1.dsc
9d323db5f1d6f3c4485ba916c746c58a56a7b002 5918032 bind9_9.20.26.orig.tar.xz
57b309593d14c600c22d83ed706894de1fe035d1 62540 bind9_9.20.26-1.debian.tar.xz
175ae6eaea1459e0a70c2e22a5c8fafd62bbe674 8878 bind9_9.20.26-1_source.buildinfo
Checksums-Sha256:
40b3fd63e7117cb194a52cc3c5abef66331bffb6d189e4d7bdc41527ce45bccd 2910 bind9_9.20.26-1.dsc
55248def0f870c4c46b3de72978ea972615131516663188a4564dca1d20bf350 5918032 bind9_9.20.26.orig.tar.xz
5d4dba75a326144e605c20631e7059046b5fcfe38a45d42182be4e19d9b312d2 62540 bind9_9.20.26-1.debian.tar.xz
a11e98fb69de9d57252a352b222ad2b5852d5f24c44768fcacc749bd3235574d 8878 bind9_9.20.26-1_source.buildinfo
Files:
23c7967dfe894cee3d11bd7a13014d9c 2910 net optional bind9_9.20.26-1.dsc
5068ac935059607d485625f80c233568 5918032 net optional bind9_9.20.26.orig.tar.xz
e4f9581f26459c509d7db2b47eef9ff4 62540 net optional bind9_9.20.26-1.debian.tar.xz
3cba34a8a34bc7090b28805d428a80f7 8878 net optional bind9_9.20.26-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmpifkhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcKtZBAAku1UNA4KFnIb4TeTkrAOaH0R7a5To9yfohs5fMofs1XpyE83fmMZjbuX
5g1U5zQ/pjJwNJnMFxc6gxzK1TOO403WrE0HgteeZJN6o4TnkGlhzU0Ixfm7EqFm
sU75aC76x1O/J3cvLGHtoB5oYPeIKylDx8M4P9KPQXPReJKKiY19P92fZakf8RiS
ynWqbuHqkkitKKe9jBsuwVfLMmPK8AdKatnrc5C9aFtQbJDza6VMrfU7yV9Oui2s
MiHKIlOPnyOpMAblAlfY9KL3d+xJvRGg2gVI/mAAvNV6T9WDzTPilfuq3Odx6ByH
kJl7Ne0rBM5tJ1xmlgSEvDNfv67FIogIHacTTrvWb6LwQ/dMwVvpybjOmPDJsV6J
ueLpKlW+JLC2hkCuo8jIyDQoK86tpQZVznjDUeHFRrexye5SUyTWarKBa22eQJ0U
i7fnq7wqzRZJ0Od3oyoSbBLG1CwvtNYiCXPwQzrzF+L37YHcPkPqeF8EVsvzJmiR
YZzDF+FuQXRDut0cHlAez1lOQ7dvyat//ffcM4yfc/Cntw8RxcOF9ZL3RxC4dF+V
Seo911MRm9fVYD96tAdwrBB+DorMXp3id2iBnMwo1K46m4/2aGHSb8yp9q7q1ntp
yAlh3SOzMRRhIBa4pJNd7KGdmyCMNUKKuqorUQ9h69hySEGEgRE=
=xVT5
-----END PGP SIGNATURE-----
