-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 13 Oct 2026 21:49:32 +0200 Source: bind9 Architecture: source Version: 1:9.18.49-1~deb12u3 Distribution: bookworm-security Urgency: high Maintainer: Debian DNS Team <team+dns@tracker.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Changes: bind9 (1:9.18.49-1~deb12u3) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * Fix CVE-2026-19033: Require a TSIG on every message of incoming zone transfers. For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, named does not rollback to the pre-transfer state. * Fix CVE-2026-19662: Prevent resolver crash with cached DNSSEC proofs. Under certain timing conditions, concurrent recursive queries could cause named to crash when cached DNSSEC NOQNAME proof data was replaced while still in use. Cached proof data is now retained until all queries using it have completed. * Fix CVE-2026-19666: DNS64 with break-dnssec could cause an assertion failure When a "dns64" statement is configured with "break-dnssec yes" and its "exclude" list matches some but not all of the addresses in an AAAA RRset, named removes the excluded addresses from the answer instead of synthesizing new ones. If the answer being filtered had been cached together with a proof that the queried name does not exist -- which is what a wildcard match produces -- named terminated with an assertion failure. * Fix CVE-2026-19667: Reject negative cache records that do not fit in a dns_rdata_t A single crafted response from a server could make a resolver cache a malformed negative entry and then terminate with an assertion failure when reading it back. Only recursive resolvers are affected, on a default configuration. * Fix CVE-2026-19941: Prevent forged DNSSEC-validated NXDOMAIN responses A validating resolver could accept a signed NSEC record from an unrelated zone as proof that a wildcard did not exist. An on-path attacker or malicious forwarder controlling a signed zone could therefore forge an authenticated NXDOMAIN response for a name that should resolve through a wildcard. BIND now requires the wildcard-denial and name-nonexistence proofs to be signed by the same zone. * Fix CVE-2026-75029: Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. A DNS message could carry the same SOA, CNAME, or DNAME record many times, and named kept every copy while parsing it. With name compression those copies took up far more memory internally than in the message itself, and every later processing step had to handle all of them. named now keeps the first copy of such a record and discards identical repeats. * Fix CVE-2026-78301: Out-of-zone records in a zone database could be served as authoritative When a zone database contained records for names outside the zone - such as a delegation above the zone apex, left behind by a secondary that had accepted out-of-zone data from its primary — the server could treat them as authoritative and answer queries for names inside the zone with that out-of-zone data instead of the zone's own. A server that was also a resolver could follow such a delegation and cache the answers of the server it named, affecting names outside the configured zone. Zone database lookups are now confined to names at or below the zone's origin. * Fix CVE-2026-80274: Crash on wildcard answers carrying both NSEC and NSEC3 proofs When a wildcard answer arrived with both NSEC and NSEC3 records at the name proving that the queried name does not exist, the resolver could pick different records when caching the answer and when retrieving the proof, depending on the order in which the authoritative server sent them. This could terminate named with an assertion failure, fail the query with SERVFAIL, or serve a denial record other than the one that had been verified. The resolver now caches and serves the same denial record it accepted when the answer was received. * Fix CVE-2026-81563 Following HTTPS/SVCB aliases could leak resolver cache memory. When a recursive server answered a query for an HTTPS or SVCB record in alias form and the alias target had more than 13 records, the target records were pinned in the cache permanently instead of being released once the answer was sent. A remote party who could make the server follow such aliases to a steady stream of fresh names could grow the cache beyond the configured max-cache-size until the server was unable to resolve unrelated names. The records are now released correctly. * Fix CVE-2026-81736: Cached HTTPS/SVCB aliases could exhaust resolver CPU A recursive resolver that had cached a large set of interlinked HTTPS or SVCB records in alias form could be driven to do an excessive amount of work assembling a single response, because it followed every cached alias target when building the additional section. A client permitted to use recursion, together with an attacker-controlled zone used to plant the records, could repeat small queries to consume enough CPU to delay or deny service to other clients. The amount of additional processing done for one query is now bounded. Checksums-Sha1: 519bed2330287bc7d62c74d82b1ca60fdc0164b6 3198 bind9_9.18.49-1~deb12u3.dsc 76b97204dfa8fc02526b9d67b5e89e4dc8a600db 5476288 bind9_9.18.49.orig.tar.xz c2bede70d7e9b074fb26a1ab7379cbd006597ecc 833 bind9_9.18.49.orig.tar.xz.asc dad4464db9ecb939b09970b6a14075e3310a4438 123504 bind9_9.18.49-1~deb12u3.debian.tar.xz e485ad369868657b3382cce8d165630130f30714 6827 bind9_9.18.49-1~deb12u3_source.buildinfo Checksums-Sha256: bd6c191cd09fbc46b0283d2e598b539079f402663f22f9c9a7bdc7194734ac44 3198 bind9_9.18.49-1~deb12u3.dsc c43ce4548ebed788cd9df63658a7de105ceafba43fcd63fa352b1093e525cd24 5476288 bind9_9.18.49.orig.tar.xz 6b92ce3f446389b630b78b3f57c7c1279cc26f662fe5b2f4da318d0144d998a8 833 bind9_9.18.49.orig.tar.xz.asc 7aab28a5ba9ad6746da6ff493a5158eb27e5e913df35398d697c9578bad81d6b 123504 bind9_9.18.49-1~deb12u3.debian.tar.xz 9772282e3058e6d888bef1bc428864a2a40107f1125f7ae02d2eb7c721f09db6 6827 bind9_9.18.49-1~deb12u3_source.buildinfo Files: 3fd0150047589aafcb3c7243cf4bd7dd 3198 net optional bind9_9.18.49-1~deb12u3.dsc 1440019616b56a6e32c8f6b52bd07583 5476288 net optional bind9_9.18.49.orig.tar.xz 19dc764f9a132a91ce95162f40cf272b 833 net optional bind9_9.18.49.orig.tar.xz.asc 3d1dbd70338c160f4f304205fb6d1a71 123504 net optional bind9_9.18.49-1~deb12u3.debian.tar.xz f4dcad3840cf6c093d44624862c5bb63 6827 net optional bind9_9.18.49-1~deb12u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmrhCTAACgkQADoaLapB CF+VbRAAh7lHUq6wjLrdWPvWR1xf181toOv0r7PU3LSZ+t/MpMdMVPAiUhdVlBXQ t0WVxa51o3Ki+Cpd8GH8ZmeKnn5RAxKm3FS9mJOci1drBhcy4wcmOtQG1YNKTgIa Mvjl/pgTSfK+tKW5U4tw0mzGIUy+UPy45Diw/YNbseuukn24lKWujjkRdldvG5b8 u6gWLV9HFel3HI3MyUAbJ2scPJww+CIdXsLPjI23Jas/AQOGCw0JzN0FI3157vQg eiH0nndwQ1taR8aCmakzvBT/T4/8Vl5s6ZVox4zK5nXEdu1++KQglWTkPNtEhcxX 8rkfJfEKB1h2eDrm783NTC+PV8jZbdjWhMm1jO0IRFh1vreEf+hRrqHmSNlCAErQ vBiBTnMt9ANLFXAGnwTusbxFgDUcziQlDZDMKdrgbbdGn3zvQUPOstSe5slqnQBB FCAlDfra8jRK+XyVLguqbQDxQddfpY9dFbP2Llc5W4hPgG1EmTgL5Ix0yk7fa5vu TSKaRhzLjTXBARijGTDxUcpCiT0uRPJDRHnB2IoJo+wDk+Ckp5jXOqqLfWQog9CV iS3p5aQ25zCcJ86rVbvl/2yc0rLtHi9EJssV0lvaiH8afXmagz7oKdKjBbFrJEgf Yy7to1WTo8qFtl72VmG5CvWcAnD+2Ri8euTHl4XUmZiGVlq3htg= =tk6+ -----END PGP SIGNATURE-----
