| 1.1.1.1 |
| 29-Aug-2026 |
christos | Import bind-9-20-27 (Previous was bind-9-20-24)
iNotes for BIND 9.20.27#
New Features#
Disclose active Negative Trust Anchors with Extended DNS Error 33.
A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a
domain, so a name that would normally fail validation resolves instead. named
now marks such answers with Extended DNS Error code 33, "Negative Trust
Anchor", so operators can see at a glance when a response came back only
because an NTA was in effect. [GL #6268]
Feature Changes#
Speed up RPZ policy zone updates.
RPZ updates used to be applied one small step at a time, adding overhead on
large policy zones. Updates are now applied as a single batch, improving
update performance for large RPZ zones, at the cost of no longer overlapping
with concurrent updates. [GL #5787] [GL #6270]
Bug Fixes#
Ensure NSEC authority does not cross zonecut boundary.
When using a cached NSEC record to prove that a delegation is insecure, named
now checks that the signer name in the corresponding RRSIG is not above a
known secure delegation point. This prevents a signed namespace from being
downgraded to insecure using an NSEC record from the grandparent zone.
[GL #5967]
Treat an unusable NSEC3 chain as a verification failure.
When transferring in a mirror zone, DNSSEC verification could incorrectly
succeed when the zone had an invalid NSEC3PARAM record, leading to subsequent
validation failures. This has been fixed. [GL #6136]
Treat non-canonical RPZ prefixes as any other failure.
RPZ prefixes that were not encoded in canonical form did not work. They are now
handled in the same way as any other encoding error. [GL #6043]
Negative caching stopped working with stale-answer-client-timeout set to 0.
Negative answers were re-fetched on every query instead of once they actually
expired, effectively disabling negative caching. This has been fixed.
[GL #6245]
An unterminated OpenSSL private-key Label: field could be read past its parser
buffer.
The Label: field in a .private key file is now checked for length and
NUL-termination. Malformed files are rejected. [GL #6193]
Restore SMF support on Solaris and illumos. [GL #6096]
Fix compilation on GNU/Hurd. [GL #6285]
dig +yaml was producing invalid YAML when a lookup failed.
When no server could be reached, dig printed its plain-text startup banner
ahead of the YAML output, making the result unparsable. dig no longer does
this and correctly reflects options such as +nocmd, +short and +yaml,
regardless of where they appear on the command line. [GL #1230]
Properly prevent TSIG generation command line injection attacks.
When key names are generated with rndc-confgen, tsig-keygen and ddns-confgen,
special characters must be escaped to ensure that the configuration is parsed
correctly. [GL #6071]
Fix a potential heap bounds overflow write in dnssec-signzone.
It was possible for dnssec-signzone to overflow array bounds while signing.
This has been fixed. [GL #6076]
Fix crashes on invalid DNSTAP input in dnstap-read.
Malformed DNSTAP files could trigger a NULL pointer dereference or an
out-of-bounds memory read in dnstap-read. This has been fixed. [GL #6077]
[GL #6124]
Notes for BIND 9.20.26#
Security Fixes#
Correct verification of NSEC3 signer name. (CVE-2026-10723)
Previously, named accepted child-zone NSEC3 records where the first label
equaled the hash of the parent zone as valid parent-zone closest encloser
proofs. This has been fixed.
ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this
vulnerability to our attention. [GL #5874]
Malformed DNSKEY records could trigger an assertion. (CVE-2026-10822)
Previously, dns_name_fromwire() did not honor the record boundary when
reading names from the wire, allowing malformed records to be accepted when
they should not have been. In particular, malformed DNSKEY records could
trigger an assertion failure when being printed. This has been fixed.
[GL #6004]
Fix handling of RPZ CNAME expansion that returns too-long name.
(CVE-2026-11331)
Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a
name that exceeded the length limit, a self-referential CNAME and the original
address record were returned, allowing the policy to be bypassed. In branches
up to 9.20 this also left query processing in an inconsistent state, which
could trigger an assertion failure. named now returns a YXDOMAIN response,
without the address.
ISC would like to thank Laith Mash'al (0xmshal) for bringing this
vulnerability to our attention. [GL #5856]
Prevent excessive validation work from crafted negative responses.
(CVE-2026-11605)
Previously, a validating resolver could be made to perform a large amount of
DNSSEC validation work in response to a single answer, consuming excessive
CPU. A malicious authoritative server could trigger this by returning a
signed negative answer (NXDOMAIN or NODATA) padded with many
denial-of-existence proof records, which the resolver continued to verify
beyond its per-query validation limit. It now enforces that limit on negative
answers and returns SERVFAIL once the limit is reached. [GL #4463]
Prevent cache exhaustion under sustained attack. (CVE-2026-11622)
Cache memory could become exhausted with expired entries whose memory was not
released, due to a sustained attack on the same DNS name that prevented the
cleanup. This has been fixed. [GL #4760]
Stop accepting invalid signed wildcard records. (CVE-2026-11721)
Signed wildcard responses in which the Labels field in the RRSIG record was
less than the number of labels in the Signer Name field were being incorrectly
accepted. This in turn broke synth-from-dnssec, which depends on such records
being correctly validated. This has been fixed.
ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this
vulnerability to our attention. [GL #5871]
Do not assert for some specific CNAME and DNAME queries. (CVE-2026-12617)
A bug in the resolver's handling of certain cached DNAME and CNAME responses
could cause named to trigger an assertion failure and exit. An attacker
controlling a domain name and the authoritative DNS server it was hosted on
could exploit this behavior to cause a denial-of-service. This has been
fixed.
ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this
vulnerability to our attention. [GL #5946]
Prevent crash from malformed NSEC/NSEC3 response. (CVE-2026-13204)
An assertion could be triggered by an improperly signed NOQNAME proof. This
has been fixed.
ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this
vulnerability to our attention. [GL #5985]
Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. (CVE-2026-13321)
Previously, a malicious zone with out-of-zone NSEC next-owner names could
cause a DNSSEC-validating resolver to cache such a record and, if
synth-from-dnssec was enabled, to generate negative answers for any zone that
was covered by the range. This has been fixed.
ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this
vulnerability to our attention. [GL #5873]
Reclaim memory promptly when DNSSEC validations are canceled.
When a resolver is flooded with queries that require DNSSEC validation - for
example during a random-subdomain attack - many of those validations are
canceled before they complete. Previously, a canceled validation still kept
its place in the internal work queue and held the associated response in
memory until that queued work eventually ran, so memory could climb sharply
under sustained load. The internal work queue is now dropped as soon as the
validation is canceled, releasing the memory it was holding. [GL #4760]
Removed Features#
Remove the secondary validator in query.c.
Previously, when the additional section of a response was being populated, if
cached data was found with pending trust, it would be opportunistically
validated. The code implementing this validation was not quite formally
correct. Rather than fixing it, the code has been removed: RRsets with
pending trust are now omitted from responses. [GL #5966] [GL #5968] [GL #5972]
Bug Fixes#
Fix a bug in DNS UPDATE processing with inline-signing enabled.
In rare cases the named process could terminate unexpectedly when processing
authorized DNS UPDATE messages in quick succession that were updating a zone
with inline-signing enabled. This has been fixed. [GL #5816]
Properly detect private records before copying.
Previously, an assertion was triggered when trying to copy a private record
to a buffer for modification. named now extends the private type detection and
copies the contents after rejecting invalid private records. [GL #5857]
Tighten referral DS acceptance.
Previously, named accepted DS records for sibling zones when it shouldn't
have. This has been fixed. [GL #5870]
Don't synthesize negative responses with pending NSEC.
If an NSEC record has not yet been validated and is cached with trust
pending, named no longer uses it to synthesize negative responses. [GL #5872]
[GL #5887] [GL #5977]
Check that an NSEC signer is at or above the name to be validated.
A check has been added to ensure that an NSEC record being used as a proof of
nonexistence for a given name is not signed by a name lower in the DNS
hierarchy than the one in question. [GL #5876]
Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
When a client sent a query with the checking-disabled (CD) bit set and the
answer was NXDOMAIN, the resolver cached that unvalidated negative response
and discarded any DNSSEC-validated records it already held for the same name,
even though the validated data was more trustworthy. A single such response -
including a forged one - could flush validated records from the cache and
force the resolver to fetch them again. The resolver now checks the trust
level of the existing data first and leaves the cache unchanged when it is
already validated. [GL #5877]
Fix a deny-answer-aliases configuration bypass issue.
It was possible to use a maliciously crafted authoritative zone to make a
named resolver synthesize a DNAME "alias" that should have been rejected by
the configured deny-answer-aliases option. This has been fixed. [GL #5930]
Reject external referrals from forwarders.
Under a forward first; policy in a forwarding zone, named could accept NS
records above the forward zone apex from negative responses. This has been
fixed. [GL #5937]
Fix a zone transfer over TLS (XoT) issue when using the opportunistic TLS
mode.
The named process, running as a secondary DNS server and configured to
transfer a zone from a primary server using an encrypted XoT transport in
opportunistic TLS mode (i.e. without peer certificate/hostname validation),
could terminate unexpectedly when the TLS ALPN negotiation with the primary
server was unsuccessful. This has been fixed. [GL #5957]
Unvalidated opt-out NSEC3 could be accepted in insecurity proof.
When determining whether an insecure delegation was legitimate, NSEC3 opt-out
records which had not yet passed validation could be used. This has been
fixed. [GL #5970]
Check wildcard signer and NOQNAME signer match.
A positive wildcard answer, and the NSEC3 proof that the requested name
doesn't exist in the zone, must both be from the same zone. Otherwise, an
NSEC3 from an ancestor zone could be used to interfere with validation.
named now retrieves the signer name from a wildcard response's signature. An
NSEC3 record cannot be used as a NOQNAME proof for the wildcard unless it
exactly matches the name one level above the NSEC3. [GL #5971]
Fix CNAME resolution failure caused by a cached SERVFAIL response.
Under certain circumstances, a cached SERVFAIL response could incorrectly
prevent successful resolution of a CNAME target. This could cause resolution
failures to persist until the cached SERVFAIL entry expired, even when the
CNAME target itself was otherwise resolvable. This has been fixed. [GL #5983]
Reject unsupported RSA DNSKEY shapes during DNSSEC validation.
An authoritative server publishing an RSA DNSKEY with an unusually large
modulus or an exotic public exponent could make each DNSSEC signature check
on a validating recursive resolver noticeably more expensive than for a
normally sized key. Such DNSKEYs are now treated as invalid. [GL #6008]
Fix a bug in GeoIP2 string matching.
When using GeoIP2 ACLs (see acl), named could incorrectly match a name using a
sub-string instead of the full name match. This has been fixed. [GL #6019]
Fix DNS-over-HTTPS (DoH) quota configuration issue.
The http-listener-clients and http-streams-per-connection configuration
options could be truncated to smaller values (or to 0, which means unlimited)
when very large configuration values in excess of 65535 were used. It is very
unlikely that such large values were used in production, and the default
values for the affected options are 300 and 100, respectively. This has been
fixed. [GL #6021]
Truncated reply to a TSIG query no longer stalls the resolver.
When an upstream server returned a truncated reply to a query that named had
signed with TSIG, the resolver could keep waiting for a follow-up UDP packet
that never arrived, stalling the query until it hit the resolver-query-timeout
and the client received no answer. named now treats any reply it cannot
authenticate as an immediate failure and returns SERVFAIL right away as a
defense in depth. [GL #6028]
Ignore updates removing DNSKEY RRset with class ANY.
When a dynamic update is received that removes the DNSKEY (or CDNSKEY, or CDS)
RRset, named now removes all records except the ones that are in use for
signing the zone. [GL #6045]
Ignore 0-byte reads in the TCP read callback.
Callbacks for libuv stream reads do not signal zero-length reads as a failure
signal but rather as EAGAIN/EWOULDBLOCK. This could trigger an assertion when
a zero-length read was pushed onto a PROXYv2 endpoint that had not yet
processed the headers, as it expected a non-NULL region of positive length.
[GL #6140]
Only print per-zone glue stats when zone-statistics is set to full.
The code printing query statistics was ignoring the zone-statistics option.
This has been fixed. [GL #6164]
CDS/CDNSKEY records were not removed when re-configuring the server.
When on an rndc reconfig the DNSSEC policy changes such that it changes the
expected CDNSKEY and/or CDS records in the zone, the RRset should be updated
accordingly. This did not happen when removing digests from the configuration,
or setting cdnskey no;. This has been fixed. [GL #6166]
Fix a crash when querying an empty non-terminal in a wildcard zone in RBTDB.
A query for an empty non-terminal in a wildcard zone served from the RBT zone
database could abort named with an assertion failure. It now returns the
correct NODATA answer. [GL #6170]
Stop reusing outgoing TCP connections the peer has already closed.
Previously, named could hand a new query to an idle forwarder/upstream TCP or
TLS connection that the peer had already closed, causing the query to fail
(and CLOSE-WAIT sockets to pile up). Idle reused connections are now watched,
so a close is noticed and the connection is dropped instead of reused. A new
tcp-reuse-timeout option controls how long an idle outgoing connection is
kept open for reuse (default 5 seconds). [GL #6171]
Fix DNSSEC validation failures for names under an apex DNAME.
DNSSEC validation could fail with SERVFAIL for names covered by a DNAME at
the apex of a signed zone, unless the zone's keys were already validated in
the cache. This regression was introduced by the recent fix for resolver
stalls on CNAME responses to DS queries, and has now been addressed.
[GL #6176]
Notes for BIND 9.20.25#
Note
The BIND 9.20.25 release was withdrawn after the discovery of a regression
in a security fix in it during pre-release testing.
|
