1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 BIND 9.20.23 13 ------------ 14 15 Security Fixes 16 ~~~~~~~~~~~~~~ 17 18 - Fix outgoing zone transfers' quota issue. ``1006b044b7`` 19 20 Unauthorized clients could consume outgoing zone transfers quota and 21 block authorized zone transfer clients. This has been fixed. 22 :gl:`#3589` 23 24 - [CVE-2026-3592] Limit resolver server list size. ``c3f3879560`` 25 26 When resolving a domain with many nameservers that share overlapping 27 IP addresses (e.g., 10 NS records all pointing at the same set of 28 addresses), BIND could previously waste time querying duplicate 29 addresses and build up excessively large server lists. Deduplicate 30 addresses in the resolver's server list so that each unique IP is only 31 queried once per resolution attempt, regardless of how many NS records 32 point to it and cap the number of addresses stored per nameserver name 33 to 6 (combined A and AAAA), preventing memory and CPU overhead from 34 domains with unusually large NS/glue sets. :gl:`#5641` 35 36 - [CVE-2026-3039] Fix GSS-API resource leak. ``92d5c60855`` 37 38 Fixed a memory leak where each GSS-API TKEY negotiation leaked a 39 security context inside the GSS library. An unauthenticated attacker 40 could exhaust server memory by sending repeated TKEY queries to a 41 server with tkey-gssapi-keytab configured. The leaked memory was 42 allocated by the GSS library, bypassing BIND's memory accounting. 43 44 Multi-round GSS-API negotiation (GSS_S_CONTINUE_NEEDED) is now 45 rejected, as BIND never supported it correctly and Kerberos/SPNEGO 46 completes in a single round. 47 48 Also implemented missing RFC 3645 requirement: the client now verifies 49 that mutual authentication and integrity flags are granted by the 50 GSS-API mechanism (Section 3.1.1). :gl:`#5752` 51 52 - [CVE-2026-5950] Avoid unbounded recursion loop. ``568be408bc`` 53 54 A bug during bad server handling could cause the resolver to enter an 55 infinite loop, continuously sending queries to an upstream server with 56 no exit condition, until the resolver query timeout was hit. This has 57 been fixed. 58 59 ISC would like to thank Billy Baraja (BielraX) for bringing this issue 60 to our attention. :gl:`#5804` 61 62 - [CVE-2026-5947] Fix crash in resolver when SIG(0)-signed responses are 63 received under load. ``9831f41894`` 64 65 A resolver could crash when handling a SIG(0)-signed response if the 66 matching client query was cancelled while signature verification was 67 still in progress for example, when the recursive-clients quota was 68 exhausted. This has been fixed. :gl:`#5819` 69 70 - [CVE-2026-3593] Add system test for HTTP/2 SETTINGS frame flood. 71 ``3be272e26d`` 72 73 A use-after-free vulnerability in the DNS-over-HTTPS implementation 74 could cause named to crash when a client sends a flood of HTTP/2 75 SETTINGS frames while a DoH response is being written. This affects 76 servers with DoH (DNS-over-HTTPS) enabled. 77 78 ISC would like to thank Naresh Kandula Parmar (Nottiboy) for reporting 79 this. 80 81 For: #5755 82 83 - [CVE-2026-5946] Disable recursion, UPDATE, and NOTIFY for non-IN 84 views. ``014be8be87`` 85 86 Recursion, dynamic updates (UPDATE), and zone change notifications 87 (NOTIFY) are now disabled for views with a class other than IN (such 88 as CHAOS or HESIOD); authoritative service for non-IN zones (e.g. 89 version.bind in class CHAOS) continues to work as before. Servers 90 configured with recursion yes in a non-IN view will log a warning at 91 startup, and named-checkconf flags the same condition. UPDATE and 92 NOTIFY messages that specify the meta-classes ANY or NONE in the 93 question section are now rejected with FORMERR. 94 95 This addresses a set of closely related security issues collectively 96 identified as CVE-2026-5946. ISC would like to thank Mcsky23 for 97 bringing these issues to our attention. 98 99 Removed Features 100 ~~~~~~~~~~~~~~~~ 101 102 - Remove obsolete KEY record EXTENDED flag deprecated by RFC 3445. 103 ``99c226576a`` 104 105 KEY resource records originally defined EXTENDED flag that was removed 106 by RFC 3445 back in 2002. BIND still carried code to parse and emit 107 it, including the additional two-octet flags field that followed when 108 the EXTENDED bit was set. That handling has been removed and the 109 affected bit positions are now reserved. 110 111 Dropping the extended-flags handling also eliminates a possible crash 112 that could be reached when signing a zone containing an invalid key. 113 :gl:`#5900` 114 115 Partial backport of MR !11961 :gl:`!11962` 116 117 Feature Changes 118 ~~~~~~~~~~~~~~~ 119 120 - Revert isdelegation() to return boolean value again. ``6d89bfdf03`` 121 122 :gl:`#5838` :gl:`!11802` 123 124 - Fix CPU spikes and slow queries when cache approaches memory limit. 125 ``e21ae6358a`` 126 127 When the cache grew close to the configured max-cache-size, every 128 subsequent entry triggered all worker threads to run cache cleanup at 129 once, causing CPU spikes and a drop in query throughput. Cleanup is 130 now spread probabilistically across inserts as memory approaches the 131 limit, so the work is distributed evenly instead of piling up at the 132 threshold. 133 134 - Fix off by one error in dnssec-ksr sign. ``819df0d19e`` 135 136 If the inception time of the signature is exactly equal to the 137 inactive time of the key, add the signature. :gl:`!11795` 138 139 Bug Fixes 140 ~~~~~~~~~ 141 142 - Check validator name when adding EDE text. ``b6c3390aea`` 143 144 When a validator is being shut down, the associated name `val->name` 145 is set to NULL. This could cause a crash if a worker thread 146 subsequently added an EDE code with `val->name` in the extra text. 147 148 `validator_addede()` now checks whether the name is NULL before trying 149 to add it to the extra text. :gl:`#5613` :gl:`!11977` 150 151 - Use the zone file's basename as origin in DNSSEC tools. ``097c14da45`` 152 153 In `dnssec-signzone` and `dnssec-verify`, when the zone origin is not 154 specified using the `-o` parameter, the default behavior is to try to 155 sign using the zone's file name as the origin. So, for example, 156 `dnssec-signzone -S example.com` will work, so long as the file name 157 matches the zone name. 158 159 This now also works if the zone is in a different directory. For 160 example, `dnssec-signzone -S zones/example.com` will set the origin 161 value to `example.com`. :gl:`#5678` :gl:`!11784` 162 163 - Fix a possible race condition during zone transfers. ``a48b287d9f`` 164 165 The :iscman:`named` process could terminate unexpectedly when 166 processing an IXFR message during a zone transfer. This has been 167 fixed. :gl:`#5767` :gl:`!11799` 168 169 - Make BIND9 compatible with OpenSSL 4. ``8242105d5d`` 170 171 OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, and that is 172 not compatible with BIND 9's memory leak detection code. Don't use 173 custom allocation/deallocation functions for OpenSSL's internal memory 174 management. 175 176 See https://github.com/openssl/openssl/pull/29721 :gl:`#5808` 177 :gl:`!11896` 178 179 - Fix named crash when processing SIG records in dynamic updates. 180 ``9e34ef0f7e`` 181 182 Previously, :iscman:`named` could abort if a client sent a dynamic 183 update containing a SIG record (the legacy signature type) to a zone 184 configured with an update-policy. The function `dns_db_findrdataset` 185 had an incorrect requirements prerequisite that prevented SIG records 186 being looked up, which was triggered as part of processing an UPDATE 187 request and could be triggered remotely by any client permitted to 188 send updates. This has been fixed by ensuring that SIG records are 189 handled consistently with RRSIG records during update processing. 190 :gl:`#5818` :gl:`!11876` 191 192 - Fix crash in resolver when SIG(0)-signed responses are received under 193 load. ``bbe0b9b8f6`` 194 195 A resolver could crash when handling a SIG(0)-signed response if the 196 matching client query was cancelled while signature verification was 197 still in progress for example, when the recursive-clients quota was 198 exhausted. This has been fixed. :gl:`#5819` 199 200 - Fix zone verification of NSEC3 signed zones. ``de4a9b4fa6`` 201 202 Previously, when computing the compressed bitmap during verification 203 of an NSEC3-signed zone, an undersized buffer was used that resulted 204 in an out-of-bounds write if there were too many active windows in the 205 bitmap. This impacted mirror zones which are NSEC3-signed, 206 `dnssec-signzone` and `dnssec-verifyzone`. This has been fixed. 207 :gl:`#5834` :gl:`!11833` 208 209 - Prevent a crash when using both dns64 and filter-aaaa. ``ddcacbc5a8`` 210 211 An assertion failure could be triggered if both `dns64` and the 212 `filter-aaaa` plugin were in use simultaneously. This happened if the 213 plugin triggered a second recursion process, which then attempted to 214 store DNS64 state information in a pointer that had already been set 215 by the original recursion process. This has been fixed. :gl:`#5854` 216 :gl:`!11967` 217 218 - Remove unnecessary dns_name_free call. ``35d94fffb0`` 219 220 When processing a catalog zone member's primaries definition and there 221 is a TXT record containing an invalid name TSIG key name, 222 dns_name_free was incorrectly called triggering an assertion. This has 223 been fixed. :gl:`#5858` :gl:`!11848` 224 225 - Tidy up the cleanup path in check_signer() ``cf517f73d5`` 226 227 When check_signer() processed a DNSKEY whose public-key data could not 228 be parsed, the early return on the parse error skipped the cleanup of 229 the cloned signature rdataset. In every code path that currently 230 reaches this function the cloned rdataset holds no resources, so no 231 memory was actually leaked, but the cleanup is restructured so the 232 parse and the iteration cannot diverge again. :gl:`#5869` :gl:`!11957` 233 234 - Prevent malicious DNSSEC zones from exhausting validator CPU. 235 ``c425827743`` 236 237 A DNSSEC-signed zone could publish a DNSKEY with an unusually large 238 RSA public exponent and force any validator resolving names in that 239 zone to spend disproportionate CPU verifying signatures. The 240 validator now rejects such DNSKEYs, matching the limit already applied 241 to keys read from files or HSMs. :gl:`#5881` :gl:`!11923` 242 243 - Fix inverted gethostname() check in rndc status. ``5ede4a87eb`` 244 245 The replacement of named_os_gethostname() with raw gethostname() 246 inverted the success check: the "localhost" fallback runs on success, 247 and on failure the uninitialized hostname buffer is read by 248 snprintf(), leaking stack memory via the rndc status reply. 249 :gl:`#5889` :gl:`!11881` 250 251 - Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits. 252 ``7e1eace6cd`` 253 254 `rndc-confgen -A hmac-sha384` and `-A hmac-sha512` documented a `-b` 255 range of 1..1024, but any value above 512 aborted on hardened builds 256 instead of producing a key. The full advertised range now works. 257 :gl:`#5903` :gl:`!11910` 258 259 - Prevent crafted queries from degrading RRL performance. ``bf4cdca7e9`` 260 261 With response rate limiting enabled, an attacker sending queries from 262 many spoofed source addresses could steer entries into the same slot 263 of the internal rate-limit table and slow down query processing on the 264 affected server. The table now uses a per-process keyed hash so the 265 placement of entries cannot be predicted or influenced from the 266 network. :gl:`#5906` :gl:`!11952` 267 268 - Fix swapped arguments in redirect2() single-label branch. 269 ``3728b405ea`` 270 271 On a recursive resolver with nxdomain-redirect configured, an NXDOMAIN 272 result for a query whose qname is the root could corrupt the view's 273 nxdomain-redirect target, after which the redirect feature stopped 274 working for every subsequent query in that view until named was 275 restarted. :gl:`#5908` :gl:`!11913` 276 277 - Free per-command rndc state when response serialisation fails. 278 ``070b394f53`` 279 280 When isccc_cc_towire failed while building an rndc reply, 281 control_respond returned without releasing the per-command request, 282 response, HMAC secret copy, and text buffer. They were eventually 283 freed when the connection closed, but until then the HMAC key copy 284 stayed in named's memory. The failure path now goes through the same 285 cleanup label as every other error. :gl:`#5913` :gl:`!11919` 286 287 - Prevent rare named crash when notifies are cancelled. ``49509dcbae`` 288 289 Under heavy load, named could occasionally crash when a queued 290 outbound notify or zone refresh was cancelled at the moment it was 291 being sent for example, while a zone was being reloaded or removed. 292 The race that caused the crash is now prevented. :gl:`#5915` 293 :gl:`!11922` 294 295 - Stop delv from aborting on a malformed query name. ``ca8315bb4d`` 296 297 delv aborts with SIGABRT instead of exiting cleanly when given a query 298 name that fails wire-format conversion (e.g. a label longer than 63 299 octets). After this change delv prints the parse error and exits with 300 a normal failure code. :gl:`#5916` :gl:`!11927` 301 302 - Fix a crash when reconfiguring while an NTA is being rechecked. 303 ``971ca4df1a`` 304 305 When named was reconfigured or shut down while a negative trust anchor 306 was being rechecked against authoritative servers, the in-flight 307 recheck could outlive the view that owned it and cause `named` to 308 crash. This has been fixed. :gl:`#5938` :gl:`!11966` 309 310 - Fix a bug in allow-query/allow-transfer catalog zone custom 311 properties. ``e962fd459e`` 312 313 The :iscman:`named` process could terminate unexpectedly when 314 processing a catalog zone with an invalid ``allow-query`` or 315 ``allow-transfer`` custom property (i.e. having a non-APL type) 316 coexisting with the valid property. This has been fixed. :gl:`#5941` 317 :gl:`!11975` 318 319 - Fix a stack use-after-free in qpzone. ``ddea991c07`` 320 321 In previous_closest_nsec(), a new qpreader was opened to search the 322 NSEC tree. It was possible for that to be used to update a QP iterator 323 object owned by the caller, and then be destroyed when the function 324 returned. 325 326 This has been addressed by having the caller open the NSEC qpreader 327 instead. :gl:`#5942` :gl:`!11956` 328 329 - Fix a memory leak issue in the catalog zones. ``5fcb6d8809`` 330 331 The :iscman:`named` process could leak small amounts of memory when 332 processing a catalog zone entry which had defined custom primary 333 servers with TSIG keys using both the regular ``primaries`` custom 334 property syntax and the legacy alternative syntax (``masters``) at the 335 same time. This has been fixed. :gl:`#5943` :gl:`!11973` 336 337 - Fix suppressed missing-glue check in named-checkzone. ``dc5eb3fe25`` 338 339 named-checkzone and named-checkconf -z silently skipped the 340 missing-glue check for any NS name that had already triggered an 341 extra-AAAA-glue warning, so zones missing required A glue could pass 342 validation and be deployed with broken delegations. :gl:`!11905` 343 344 - Implement seamless outgoing TCP connection reuse. ``eb117e16b9`` 345 346 The resolver can and will reuse outgoing TCP connections to the same 347 host, as recommended by RFC 7766. This prevents a whole class of 348 attacks that abuse the fact that establishing a TCP connection is 349 expensive and it is fairly easy to deplete the outgoing TCP ports by 350 putting them into TIME_WAIT state. 351 352 The number of pipelined queries per connection is capped at 256 to 353 limit the impact of a connection drop. :gl:`!11846` 354 355 - Pass empty string instead of NULL to ns_client_dumpmessage() 356 ``24cdf8c096`` 357 358 Pass "" instead of NULL to ns_client_dumpmessage() to get the log 359 message printed. 360 361 - Reject record sets too large to serve in DNS. ``933a8de056`` 362 363 When BIND was asked to store a record set whose total size exceeds 364 what fits in a DNS message, it would allocate memory and build the 365 structure, then fail later at response time. Such oversized record 366 sets are now rejected at the time of storage with an error, avoiding 367 wasted work on data that can never be served. :gl:`!11964` 368 369 370
Indexes created Mon Oct 26 00:26:21 UTC 2026