1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 BIND 9.20.29 13 ------------ 14 15 Security Fixes 16 ~~~~~~~~~~~~~~ 17 18 - [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC 19 responses. ``a0a61dba9e`` 20 21 A malicious authoritative server could serve a securely delegated zone 22 whose DS and DNSKEY records carry many distinct key tags but no valid 23 match, forcing a validating resolver into excessive key-tag matching 24 and high CPU use for every query. BIND now bounds this work with the 25 per-query validation limit (max-validations-per-fetch). :gl:`#5349` 26 27 - [CVE-2026-19033] Require a TSIG on every message of incoming zone 28 transfers. ``9404cd2b8c`` 29 30 BIND 9 used to accept TSIG-signed zone transfers in which some 31 messages were unsigned, and processed those messages before the next 32 signature could vouch for them. It now requires a TSIG on every 33 message of an incoming AXFR or IXFR; all modern nameserver already 34 sign every message, so no change is expected in practice. :gl:`#6062` 35 36 - [CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via 37 unrelated NSEC3. ``3bed9c8e9e`` 38 39 A validating resolver could be tricked into treating a secure 40 delegation as unsigned and accepting forged answers for names beneath 41 it, if an attacker could inject responses to its queries. Such forged 42 proofs are now rejected. :gl:`#6234` 43 44 - [CVE-2026-19941] Prevent forged DNSSEC-validated NXDOMAIN responses. 45 ``a36bf58daf`` 46 47 A validating resolver could accept a signed NSEC record from an 48 unrelated zone as proof that a wildcard did not exist. An on-path 49 attacker or malicious forwarder controlling a signed zone could 50 therefore forge an authenticated NXDOMAIN response for a name that 51 should resolve through a wildcard. BIND now requires the 52 wildcard-denial and name-nonexistence proofs to be signed by the same 53 zone. :gl:`#6253` 54 55 - [CVE-2026-19666] DNS64 with break-dnssec could cause an assertion 56 failure. ``4cec4965c4`` 57 58 When a "dns64" statement is configured with "break-dnssec yes" and its 59 "exclude" list matches some but not all of the addresses in an AAAA 60 RRset, named removes the excluded addresses from the answer instead of 61 synthesizing new ones. If the answer being filtered had been cached 62 together with a proof that the queried name does not exist -- which is 63 what a wildcard match produces -- named terminated with an assertion 64 failure. 65 66 Only recursive resolvers are affected, and only when "break-dnssec 67 yes" is in use; the answer has to come from the cache, so a server 68 that is only authoritative cannot reach this. :gl:`#6301` 69 70 - [CVE-2026-19667] Reject negative cache records that do not fit in a 71 dns_rdata_t. ``dbf08c8581`` 72 73 A single crafted response from a server could make a resolver cache a 74 malformed negative entry and then terminate with an assertion failure 75 when reading it back. Only recursive resolvers are affected, on a 76 default configuration. :gl:`#6302` 77 78 - [CVE-2026-19662] Prevent resolver crash with cached DNSSEC proofs. 79 ``c884cc1ba0`` 80 81 Under certain timing conditions, concurrent recursive queries could 82 cause named to crash when cached DNSSEC NOQNAME proof data was 83 replaced while still in use. Cached proof data is now retained until 84 all queries using it have completed. :gl:`#6333` 85 86 - [CVE-2026-75029] Discard repeated SOA, CNAME, and DNAME records when 87 parsing DNS messages. ``0d630758c2`` 88 89 A DNS message could carry the same SOA, CNAME, or DNAME record many 90 times, and named kept every copy while parsing it. With name 91 compression those copies took up far more memory internally than in 92 the message itself, and every later processing step had to handle all 93 of them. named now keeps the first copy of such a record and discards 94 identical repeats. :gl:`#6335` 95 96 - [CVE-2026-77692] Fix an unauthenticated crash on HTTPS using SIG(0) 97 ``5a24401c5c`` 98 99 A specifically crafted HTTPS query using SIG(0) as authentication 100 could crash named if the client closes the connection before named 101 actually verifies the signature. This is now fixed. :gl:`#6343` 102 103 - [CVE-2026-81736] Cached HTTPS/SVCB aliases could exhaust resolver CPU. 104 ``20bbb1639a`` 105 106 A recursive resolver that had cached a large set of interlinked HTTPS 107 or SVCB records in alias form could be driven to do an excessive 108 amount of work assembling a single response, because it followed every 109 cached alias target when building the additional section. A client 110 permitted to use recursion, together with an attacker-controlled zone 111 used to plant the records, could repeat small queries to consume 112 enough CPU to delay or deny service to other clients. The amount of 113 additional processing done for one query is now bounded. :gl:`#6347` 114 115 - [CVE-2026-76163] Prevent TKEY queries from terminating named without 116 global options. ``7645138538`` 117 118 named could terminate unexpectedly when a remote client sent a TKEY 119 query if the configuration did not include a global options statement. 120 This has been fixed. 121 122 ISC thanks Owais Lone (thesecguy) for reporting the issue. :gl:`#6357` 123 124 - [CVE-2026-78301] Out-of-zone records in a zone database could be 125 served as authoritative. ``72a10c3a0b`` 126 127 When a zone database contained records for names outside the zone 128 such as a delegation above the zone apex, left behind by a secondary 129 that had accepted out-of-zone data from its primary the server could 130 treat them as authoritative and answer queries for names inside the 131 zone with that out-of-zone data instead of the zone's own. A server 132 that was also a resolver could follow such a delegation and cache the 133 answers of the server it named, affecting names outside the configured 134 zone. Zone database lookups are now confined to names at or below the 135 zone's origin. 136 137 ISC would like to thank Henrique Pereira for reporting the issue. 138 :gl:`#6361` 139 140 - [CVE-2026-80274] Crash on wildcard answers carrying both NSEC and 141 NSEC3 proofs. ``0e44451b1a`` 142 143 When a wildcard answer arrived with both NSEC and NSEC3 records at the 144 name proving that the queried name does not exist, the resolver could 145 pick different records when caching the answer and when retrieving the 146 proof, depending on the order in which the authoritative server sent 147 them. This could terminate named with an assertion failure, fail the 148 query with SERVFAIL, or serve a denial record other than the one that 149 had been verified. The resolver now caches and serves the same denial 150 record it accepted when the answer was received. 151 152 ISC would like to thank hythyt for reporting the issue. :gl:`#6369` 153 154 - [CVE-2026-81563] Following HTTPS/SVCB aliases could leak resolver 155 cache memory. ``3162df369e`` 156 157 When a recursive server answered a query for an HTTPS or SVCB record 158 in alias form and the alias target had more than 13 records, the 159 target records were pinned in the cache permanently instead of being 160 released once the answer was sent. A remote party who could make the 161 server follow such aliases to a steady stream of fresh names could 162 grow the cache beyond the configured max-cache-size until the server 163 was unable to resolve unrelated names. The records are now released 164 correctly. 165 166 ISC would like to thank Samy Medjahed/Ap4sh for reporting the issue. 167 :gl:`#6374` 168 169 New Features 170 ~~~~~~~~~~~~ 171 172 - Add an agent skill for the isc_job/isc_async/isc_work APIs. 173 ``fe32990b06`` 174 175 Documents when to use isc_job_run(), isc_async_run() or 176 isc_work_enqueue(), and the contract each one imposes. No functional 177 change. :gl:`!12561` 178 179 Removed Features 180 ~~~~~~~~~~~~~~~~ 181 182 - Remove unused closest encloser proof caching. ``abd8b5bfd8`` 183 184 BIND used to cache an NSEC3 closest encloser proof alongside positive 185 wildcard answers so that a resolver could re-send it when answering 186 from its cache. That stopped being used in BIND 9.9 (2011), when 187 positive wildcard responses were changed to omit that NSEC3 record 188 RFC 5155 requires only the next closer name proof and the closest 189 encloser came to be derived during validation instead. The caching 190 code has been unreachable ever since, so this removes it with no 191 change in behaviour. :gl:`#5803` :gl:`!12660` 192 193 Feature Changes 194 ~~~~~~~~~~~~~~~ 195 196 - Reject oversized and malformed DNSKEY records up front. ``6c22109924`` 197 198 Oversized RSA key material in a DNSKEY record was only rejected after 199 it had been converted, allocating memory proportional to the record 200 size. Such records are now rejected before conversion, as are Ed25519 201 and Ed448 keys with trailing bytes that were previously silently 202 ignored. :gl:`#4537` :gl:`!12560` 203 204 Bug Fixes 205 ~~~~~~~~~ 206 207 - Prevent a crash when using both dns64 and filter-a. ``bce5d10d18`` 208 209 An assertion failure was possible when using both `dns64` and the 210 `filter-a` plugin simultaneously; this has been fixed. :gl:`#5979` 211 :gl:`!12663` 212 213 - Fix update-policy grant external address passing. ``b1e955c326`` 214 215 Only TCP client addresses are supposed to be passed to an `external` 216 handler for the associated `update-policy` rule, but UDP client 217 addresses were also being passed. This could have caused the external 218 handler to return a result it otherwise wouldn't. This has been fixed. 219 :gl:`#6061` :gl:`!12555` 220 221 - Missing required NSEC3 for delegation not detected. ``e84ed2e9d7`` 222 223 A missing required NSEC3 record for an insecure delegation in a non 224 OPTOUT range was not being detected. This has been fixed. :gl:`#6063` 225 :gl:`!12611` 226 227 - Tighten EUI48 and EUI48 text parsing. ``ff50f2cdf1`` 228 229 Malformed EUI48 and EUI64 records could be accepted. This has been 230 fixed. :gl:`#6082` :gl:`!12521` 231 232 - GeoIP ACL state can be stale or wrong after reload. ``63baf425b3`` 233 234 `named` caches GeoIP information after looking it up, but the cached 235 information was not invalidated when the GeoIP database was reloaded, 236 so it could continue to be used. We now invalidate existing cached 237 GeoIP information as part of the reloading process. :gl:`#6083` 238 :gl:`!12662` 239 240 - Honor DNSSEC policy key tag ranges. ``b82e5834b7`` 241 242 When a DNSSEC policy configured a non-default tag-range, dnssec-keygen 243 and dnssec-ksr could accept generated keys outside that range. Both 244 tools now honor the configured minimum and maximum key tags. 245 :gl:`#6091` :gl:`!12549` 246 247 - Fix double free in mdig when EDNS options are specified. 248 ``af5bd0b0ff`` 249 250 When the default_query is cloned the EDNS options need to be cloned 251 rather than the pointer copied. The old behaviour results in a double 252 free of the options. This has been fixed. :gl:`#6095` :gl:`!12661` 253 254 - Fix a crash when an IXFR falls back to AXFR with updates still 255 pending. ``e34062bc7e`` 256 257 When a secondary zone received an incremental transfer (IXFR) and the 258 primary then caused named to fall back to a full transfer (AXFR) while 259 some of the already-received incremental changes were still waiting to 260 be applied, named could later crash when that transfer finished. The 261 pending changes are now discarded correctly before the AXFR retry. 262 :gl:`#6114` :gl:`!12624` 263 264 - Fix DS requests to parental agents over TLS. ``55830d30f6`` 265 266 TLS configuration for parental agents was being ignored when sending 267 DS requests. This has been fixed. :gl:`#6135` :gl:`!12613` 268 269 - Fix a crash when resolving names below a cached DNAME. ``b94e940f52`` 270 271 A recursive resolver could crash when it answered a query for a name 272 beneath a cached DNAME while that same DNAME record was concurrently 273 refreshed or evicted from the cache. :gl:`#6182` :gl:`!12593` 274 275 - Rndc-confgen `-q` (quiet) option is documented but doesn't work. 276 ``7e4a7ca1a7`` 277 278 The command line parsing in rndc-confgen was broken so `rndc-confgen 279 -q` did not work. This has been fixed. :gl:`#6187` :gl:`!12575` 280 281 - Enforce query ACLs for redirect zones and searched DLZs. 282 ``bc69876b2e`` 283 284 Queries answered from redirect zones or searched DLZ databases did not 285 consistently honor `allow-query` and `allow-query-on`, potentially 286 exposing restricted DNS data to excluded clients or through excluded 287 listening addresses. These ACLs are now enforced before redirect or 288 DLZ data is returned. :gl:`#6251`, #6252 :gl:`!12646` 289 290 - Check "asnum" validity in GeoIP ACLs. ``28c2bfdc7b`` 291 292 We now check the validity of autonomous system (AS) numbers when 293 parsing GeoIP ACLs that use `asnum` elements at configuration time. 294 295 `asnum` values start with an optional case-insensitive "AS" prefix, 296 followed only by decimal digits, with no spaces or other extraneous 297 characters. The value represented cannot exceed 2^32. :gl:`#6255` 298 :gl:`!12511` 299 300 - Prevent crashes while reporting DNSSEC signing statistics. 301 ``c190514f0a`` 302 303 Servers with zone-statistics full could terminate while reporting 304 DNSSEC signing statistics for a zone tracking adding more than four 305 signing keys. :gl:`#6256` :gl:`!12674` 306 307 - Fix various nits in the netmgr code. ``c28cdad51b`` 308 309 The MR consists of couple of small fixes and uncaught errors in the 310 Network Manager. :gl:`#6257` :gl:`!12576` 311 312 - Fix a crash on remote-servers lists that reference themselves. 313 ``aaae614f9d`` 314 315 Since 9.21.16 and 9.20.17, a remote-servers, primaries, masters, or 316 parental-agents list that referenced itself, directly or through 317 another list, made named crash on startup or reconfiguration. Such 318 references are again skipped and the remaining entries in the list are 319 used, as in earlier versions. :gl:`#6287` :gl:`!12604` 320 321 - A record from outside a response policy zone could stop named. 322 ``d135513b37`` 323 324 A response policy zone transferred from a primary can contain a record 325 whose name lies outside the zone. Such a record could stop named, both 326 when it arrived and again at every startup afterwards, because a 327 secondary keeps it in its own copy of the zone. Records like this are 328 now rejected and logged; previously one could also silently create a 329 policy entry for an unrelated name. :gl:`#6304` :gl:`!12543` 330 331 - "rndc flushtree ." failed to flush the cache. ``96e8b585ed`` 332 333 `rndc flushtree` flushes cache data below a specified name. If the 334 name specified is the DNS root, it should fully empty the cache, the 335 same as `rndc flush`. However, there was a bug causing the command, 336 in that case, to have no effect on the cache at all; this has been 337 fixed. :gl:`#6308` :gl:`!12582` 338 339 - Invalid key-store configuration could abort the DNSSEC tools. 340 ``1d796ab072`` 341 342 Invalid configured key-stores named "key-directory" in configuration 343 files could abort the DNSSEC tools. This has been fixed. :gl:`#6313` 344 :gl:`!12653` 345 346 - NSEC signature set could bypass the secure-delegation check. 347 ``c966177f6c`` 348 349 When proving that a delegation is insecure, the validator bounded an 350 NSEC record's authority by the signer of whichever RRSIG happened to 351 come first in the record's signature set, rather than the signature 352 that actually verified. A grandparent NSEC padded with an extra, 353 unverifiable signature could therefore pass the check that keeps such 354 proofs from reaching below a signed child zone. The validator now 355 requires every signature on the NSEC to name the same signer and 356 refuses proofs whose signature set is malformed or larger than 357 max-validations-per-fetch allows. :gl:`#6321` 358 359 - Fix a possible nsupdate issue when using GSS-TSIG. ``4ddcab2d3c`` 360 361 The :iscman:`nsupdate` process could terminate unexpectedly when using 362 the GSS-TSIG mode executed with the :option:`nsupdate -g` option. This 363 has been fixed. :gl:`#6325` :gl:`!12588` 364 365 - Fix isccc_alist_define error paths. ``af1349552a`` 366 367 If there is an out of memory error in isccc_alist_define a memory leak 368 (the sexpr holding the key name) or a double free (value) could occur. 369 This has been fixed. :gl:`#6329` :gl:`!12636` 370 371 - Check for empty 'endpoints' list. ``23f58af443`` 372 373 Configuring an `http` block with `endpoints {};` previously caused a 374 crash in `named`. This is now rejected earlier by the configuration 375 check. :gl:`#6330` :gl:`!12552` 376 377 - Named could crash with a single-element geoip sortlist. ``0e996a4d3b`` 378 379 If `named` was configured with a single-element sortlist containing a 380 `geoip` ACL element, any matching query triggered an assertion 381 failure. This has been fixed. :gl:`#6342` :gl:`!12583` 382 383 - Prevent out-of-bailiwick CNAMEs from evicting cached records. 384 ``cdedd4acd5`` 385 386 A recursive resolver could remove valid cached records when a DNS 387 response contained an out-of-bailiwick CNAME with the same owner name. 388 Out-of-bailiwick data is now discarded before it can modify the cache. 389 :gl:`#6345` :gl:`!12651` 390 391 - Restore periodic cleanup of stale resolver address data. 392 ``356f4013f8`` 393 394 Stale resolver address data could remain cached until memory pressure 395 or an explicit flush. Correct the cleanup interval so it is removed 396 periodically. :gl:`#6346` :gl:`!12589` 397 398 - Fix named-checkconf/named crash with malformed key name. 399 ``9f218f6aaf`` 400 401 When a primary/remote-server key name was malformed, named-checkconf 402 and named were both crashing (after warning about the invalid key 403 name). This is now fixed. :gl:`#6362` :gl:`!12639` 404 405 - Fix -Wformat-truncation warning in totext_in_wks() ``f97c2bea40`` 406 407 BIND 9 failed to build with GCC 16 at -O3: rendering a WKS record as 408 text triggered a -Wformat-truncation error, which is fatal in 409 developer builds. The port number is now printed with a 16-bit format 410 specifier, so the compiler can see it always fits the output buffer. 411 :gl:`!12542` 412 413 - Fix off-by-one errors caused by magic hardcoded values. ``726c6cb795`` 414 415 Fix off-by-one comparinson errors: "named -p http=" dropped the first 416 digit of the given port (for example, "http=8080" selected port 80) 417 and now uses the port as given, and "named-rrchecker -C" compared only 418 part of the "CLASS" prefix when filtering generic class names, which 419 was harmless in practice but is now corrected. :gl:`!12616` 420 421 - Hmac_verify() now accepts truncated HMACs only when requested. 422 ``c81b111496`` 423 424 The hmac_verify() function incorrectly compares only up to 425 'sig->length' bytes, but the signature and its length should not be 426 trusted, e.g. in case if it comes from a user query. 427 428 Don't accept signatures which length isn't equal to the expected 429 calculated HMAC length unless it is explicitly requested by the 430 caller, e.g. for truncated TSIG [1] support. 431 432 [1] https://datatracker.ietf.org/doc/html/rfc8945#name-tsig-truncation 433 -policy :gl:`!12629` 434 435 - Prevent resolver crashes while processing DNS over TCP. ``81b3b6d89f`` 436 437 Recursive resolvers could terminate with an assertion failure while 438 processing DNS responses over TCP under sustained traffic. The failure 439 was observed on resolvers configured globally with forward only; the 440 same transport path is also used by iterative resolution. This has 441 been fixed. :gl:`!12537` 442 443 444
Indexes created Mon Oct 26 00:26:21 UTC 2026