bind9 - Debian Package Tracker

general

source: bind9 (main)
version: 1:9.20.30-1
maintainer: Debian DNS Team (DMD)
uploaders: Ondřej Surý [DMD] – Bernhard Schmidt [DMD]
arch: all any
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:9.16.50-1~deb11u2
o-o-sec: 1:9.16.50-1~deb11u6
o-o-p-u: 1:9.16.50-1~deb11u2
oldstable: 1:9.18.49-1~deb12u1
old-sec: 1:9.18.49-1~deb12u3
old-bpo: 1:9.20.26-1~deb13u1~bpo12+1
old-p-u: 1:9.18.49-1~deb12u1
stable: 1:9.20.23-1~deb13u1
stable-sec: 1:9.20.30-1~deb13u1
stable-p-u: 1:9.20.29-1~deb13u1
testing: 1:9.20.30-1
unstable: 1:9.20.30-1
exp: 1:9.21.26-1

versioned links

1:9.16.50-1~deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.16.50-1~deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.18.49-1~deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.18.49-1~deb12u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.20.4-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.20.23-1~deb13u1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.20.23-1~deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.20.26-1~deb13u1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.20.30-1~deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.20.30-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.21.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:9.21.26-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

bind9 (16 bugs: 0, 11, 5, 0)
bind9-dev
bind9-dnsutils (1 bugs: 0, 1, 0, 0)
bind9-doc (3 bugs: 0, 2, 1, 0)
bind9-host (1 bugs: 0, 1, 0, 0)
bind9-libs (2 bugs: 0, 0, 2, 0)
bind9-utils (1 bugs: 0, 1, 0, 0)

action needed

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

https://salsa.debian.org/api/v4/projects/dns-team%2Fbind9 API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2023-04-21 Last update: 2026-10-29 00:21

8 security issues in bookworm high

There are 8 open security issues in bookworm.

8 important issues:

CVE-2026-19630: In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-19668: A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CVE-2026-76163: If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
CVE-2026-77119: A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
CVE-2026-77692: An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.
CVE-2026-94300: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-96888: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-97313: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Created: 2026-09-16 Last update: 2026-10-28 00:30

2 security issues in buster high

There are 2 open security issues in buster.

1 important issue:

CVE-2023-4408: The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.

1 ignored issue:

CVE-2022-3094: Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.

Created: 2024-02-13 Last update: 2024-06-29 13:15

Depends on packages which need a new maintainer normal

The packages that bind9 depends on which need a new maintainer are:

db-defaults (#1055344)
- Build-Depends: libdb-dev

Created: 2023-11-04 Last update: 2026-10-30 08:30

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-30 08:00

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

dnsutils could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2026-10-30 04:01

lintian reports 30 warnings normal

Lintian reports 30 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-02 Last update: 2026-10-22 23:30

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 1:9.20.30-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-22 19:33

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-03-24 Last update: 2020-03-24 06:20

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.2).

Created: 2024-04-07 Last update: 2026-10-22 15:20

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-10-29] Accepted bind9 1:9.20.30-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-10-27] Accepted bind9 1:9.18.49-1~deb12u3 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-10-24] bind9 1:9.20.30-1 MIGRATED to testing (Debian testing watch)
[2026-10-22] Accepted bind9 1:9.20.30-1 (source) into unstable (Ondřej Surý)
[2026-10-21] Accepted bind9 1:9.20.30-1~deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-09-21] Accepted bind9 1:9.20.29-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-09-19] bind9 1:9.20.29-1 MIGRATED to testing (Debian testing watch)
[2026-09-17] Accepted bind9 1:9.20.29-1~deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-09-16] Accepted bind9 1:9.21.26-1 (source) into experimental (Ondřej Surý)
[2026-09-16] Accepted bind9 1:9.20.29-1 (source) into unstable (Ondřej Surý)
[2026-09-06] bind9 1:9.20.27-2 MIGRATED to testing (Debian testing watch)
[2026-09-01] Accepted bind9 1:9.20.27-2 (source) into unstable (Bernhard Schmidt)
[2026-08-25] bind9 1:9.20.27-1 MIGRATED to testing (Debian testing watch)
[2026-08-19] Accepted bind9 1:9.21.25-1 (source) into experimental (Ondřej Surý)
[2026-08-19] Accepted bind9 1:9.20.27-1 (source) into unstable (Ondřej Surý)
[2026-08-08] Accepted bind9 1:9.16.50-1~deb11u6 (source) into oldoldstable-security (Emmanuel Arias)
[2026-08-07] Accepted bind9 1:9.18.49-1~deb12u2 (source) into oldstable-security (Emmanuel Arias)
[2026-07-28] bind9 1:9.20.26-1 MIGRATED to testing (Debian testing watch)
[2026-07-23] Accepted bind9 1:9.20.26-1~deb13u1~bpo12+1 (source) into oldstable-backports (Bernhard Schmidt)
[2026-07-23] Accepted bind9 1:9.20.26-1 (source) into unstable (Ondřej Surý)
[2026-07-23] Accepted bind9 1:9.20.26-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-07-22] Accepted bind9 1:9.20.26-1~deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-06-26] bind9 1:9.20.24-1 MIGRATED to testing (Debian testing watch)
[2026-06-17] Accepted bind9 1:9.21.23-1 (source) into experimental (Ondřej Surý)
[2026-06-17] Accepted bind9 1:9.20.24-1 (source) into unstable (Ondřej Surý)
[2026-06-14] Accepted bind9 1:9.20.23-1~deb13u1~bpo12+1 (source) into oldstable-backports (Bernhard Schmidt)
[2026-05-24] bind9 1:9.20.23-1 MIGRATED to testing (Debian testing watch)
[2026-05-23] Accepted bind9 1:9.20.23-1~deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-05-22] Accepted bind9 1:9.18.49-1~deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Ondřej Surý)
[2026-05-20] Accepted bind9 1:9.21.22-1 (source) into experimental (Ondřej Surý)

bugs [bug history graph]

all: 26 27
RC: 0
I&N: 15 16
M&W: 11
F&P: 0
patch: 3

links

homepage
lintian (0, 30)
buildd: logs, exp, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:9.20.24-1ubuntu3
71 bugs (4 patches)
patches for 1:9.20.24-1ubuntu3