This update for bind fixes the following issues:
- CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430).
- CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432).
- CVE-2026-19666: Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (bsc#1280433).
- CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dns_ncache_add() (bsc#1280435).
- CVE-2026-19668: Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (bsc#1280436).
- CVE-2026-19941: checkwildcard() accepts an out-of-zone NSEC as a wildc
This update for bind fixes the following issues:
Upgrade to release 9.20.26.
Security issues fixed:
- CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
- CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
- CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
- CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985).
- CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
- CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987).
- CVE-2026-12617: record order
This update for bind fixes the following issues:
Security issues:
- CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
- CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
- CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
- CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
- CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
- CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Non security issue:
- bind test failed with versi
This update for bind fixes the following issues:
Security issues:
- CVE-2026-1519: maliciously crafted DNSSEC-validated zone can lead to denial of service (bsc#1260805).
- CVE-2026-3104: memory leak in code preparing DNSSEC proofs of non-existence allows for DoS (bsc#1260567).
- CVE-2026-3119: authenticated queries containing a TKEY record may cause `named` to terminate unexpectedly
(bsc#1260568).
- CVE-2026-3591: stack use-after-return flaw in SIG(0) handling code allows for ACL bypass (bsc#1260569).
- use-after-free error in `dns_client_resolve()` triggered by a DNAME response (bsc#1259202).
Upgrade to release 9.20.21
Security Fixes:
This update for bind fixes the following issues:
Upgrade to release 9.20.18:
- CVE-2025-13878: Fixed incorrect length checks for BRID and HHIT records (bsc#1256997)
Feature Changes:
* Add more information to the rndc recursing output about
fetches.
* Reduce the number of outgoing queries.
* Provide more information when memory allocation fails.
Bug Fixes:
* Make DNSSEC key rollovers more robust.
* Fix a catalog zone issue, where member zones could fail to
load.
* Allow glue in delegations with QTYPE=ANY.
* Fix slow speed when signing a large delegation zone with NSEC3
opt-out.
* Reconfiguring an NSEC3 opt-o
This update for bind fixes the following issues:
Upgrade to release 9.20.15:
- CVE-2025-8677: DNSSEC validation fails if matching but invalid DNSKEY is found (bsc#1252378).
- CVE-2025-40778: Address various spoofing attacks (bsc#1252379).
- CVE-2025-40780: Cache-poisoning due to weak pseudo-random number generator (bsc#1252380).
This update for bind fixes the following issues:
- Upgrade to release 9.20.11
- CVE-2025-40777: Fixed a possible assertion failure when stale-answer-client-timeout is set to 0. (bsc#1246548)
This update for bind fixes the following issues:
Update to version 9.20.9.
- Security issues fixed:
* CVE-2025-40775: denial-of-service due to assertion failure caused by the processing of a NS message with an invalid
TSIG (bsc#1243361).
* CVE-2024-12705: CPU and memory exhaustion due to DNS-over-HTTPS issues that arise under heavy query load
(bsc#1236597).
* CVE-2024-11187: CPU exhaustion when processing queries that lead to responses containing several records in the
Additional data section (bsc#1236596).
- Changelog:
- Feature changes:
* Performance optimization for NSEC3 lookups introduced in BIND 9.20.2