doc/notes/notes-9.20.29.rst

.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
..
.. SPDX-License-Identifier: MPL-2.0
..
.. This Source Code Form is subject to the terms of the Mozilla Public
.. License, v. 2.0.  If a copy of the MPL was not distributed with this
.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
..
.. See the COPYRIGHT file distributed with this work for additional
.. information regarding copyright ownership.

Notes for BIND 9.20.29
----------------------

Security Fixes
~~~~~~~~~~~~~~

- Prevent excessive CPU use validating crafted DNSSEC responses.
  :cve:`2026-19668`

  A malicious authoritative server could serve a securely delegated zone
  whose DS and DNSKEY records carried many distinct key tags but no valid
  match, forcing a validating resolver into excessive key-tag matching
  and high CPU use for every query. This work is now bounded by the
  per-query validation limit (:any:`max-validations-per-fetch`).

  ISC would like to thank Zuyao Xu and Xiang Li of the All-in-One
  Security and Privacy Laboratory, Nankai University, for bringing this
  vulnerability to our attention. :gl:`#5349`

- Require a TSIG on every message of incoming zone transfers.
  :cve:`2026-19033`

  Previously, :iscman:`named` accepted TSIG-signed zone transfers in
  which some messages were unsigned, and processed those messages
  before the next signature could vouch for them. It now requires a
  TSIG on every message of an incoming AXFR or IXFR; all modern
  nameservers already sign every message, so no change is expected in
  practice. :gl:`#6062`

- Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3
  records. :cve:`2026-77119`

  A validating resolver could be tricked into treating a secure
  delegation as unsigned and accepting forged answers for names beneath
  it, if an attacker could inject responses to its queries. Such forged
  proofs are now rejected. :gl:`#6234`

- Prevent forged DNSSEC-validated NXDOMAIN responses. :cve:`2026-19941`

  A validating resolver could accept a signed NSEC record from an
  unrelated zone as proof that a wildcard did not exist. An on-path
  attacker or malicious forwarder controlling a signed zone could
  therefore forge an authenticated NXDOMAIN response for a name that
  should resolve through a wildcard. The wildcard-denial and
  name-nonexistence proofs are now required to be signed by the same
  zone. :gl:`#6253`

- DNS64 with :any:`break-dnssec` could cause an assertion failure.
  :cve:`2026-19666`

  When a :any:`dns64` statement is configured with ``break-dnssec yes;``
  and its ``exclude`` list matches some but not all of the addresses in
  an AAAA RRset, :iscman:`named` removes the excluded addresses from the
  answer instead of synthesizing new ones. If the answer being filtered
  had been cached together with a proof that the queried name did not
  exist  which is what a wildcard match produces  :iscman:`named`
  terminated with an assertion failure.

  Only recursive resolvers are affected, and only when
  ``break-dnssec yes;`` is in use; the answer has to come from the
  cache, so a server that is only authoritative cannot reach this.

  ISC would like to thank Rintaro Kawasugi for bringing this
  vulnerability to our attention. :gl:`#6301`

- Reject oversized negative cache records. :cve:`2026-19667`

  A single crafted response from a server could make a resolver cache a
  malformed negative entry and then terminate with an assertion failure
  when reading it back. Only recursive resolvers are affected, on a
  default configuration.

  ISC would like to thank Rintaro Kawasugi for bringing this
  vulnerability to our attention. :gl:`#6302`

- Prevent resolver crash with cached DNSSEC proofs. :cve:`2026-19662`

  Under certain timing conditions, concurrent recursive queries could
  cause :iscman:`named` to crash when cached DNSSEC NOQNAME proof data
  was replaced while still in use. Cached proof data is now retained
  until all queries using it have completed.

  ISC would like to thank Samy Medjahed/Ap4sh for bringing this
  vulnerability to our attention. :gl:`#6333`

- Discard repeated SOA, CNAME, and DNAME records when parsing DNS
  messages. :cve:`2026-75029`

  A DNS message could carry the same SOA, CNAME, or DNAME record many
  times, and :iscman:`named` kept every copy while parsing it. With name
  compression those copies took up far more memory internally than in
  the message itself, and every later processing step had to handle all
  of them. Only the first copy of such a record is now kept; identical
  repeats are discarded. :gl:`#6335`

- Fix an unauthenticated crash on HTTPS using SIG(0). :cve:`2026-77692`

  A specifically crafted HTTPS query using SIG(0) as authentication
  could crash :iscman:`named` if the client closed the connection before
  :iscman:`named` actually verified the signature. This is now fixed.

  ISC would like to thank Vitaly Simonovich for bringing this
  vulnerability to our attention. :gl:`#6343`

- Cached HTTPS/SVCB aliases could exhaust resolver CPU.
  :cve:`2026-81736`

  A recursive resolver that had cached a large set of interlinked HTTPS
  or SVCB records in alias form could be driven to do an excessive
  amount of work assembling a single response, because it followed every
  cached alias target when building the additional section. A client
  permitted to use recursion, together with an attacker-controlled zone
  used to plant the records, could repeat small queries to consume
  enough CPU to delay or deny service to other clients. The amount of
  additional processing done for one query is now bounded.

  ISC would like to thank Henrique Pereira for bringing this
  vulnerability to our attention. :gl:`#6347`

- Prevent TKEY queries from terminating :iscman:`named` without global
  options. :cve:`2026-76163`

  The :iscman:`named` process could terminate unexpectedly when a remote
  client sent a TKEY query and the configuration did not include a
  global :namedconf:ref:`options` statement. This has been fixed.

  ISC would like to thank Owais Lone (thesecguy) for bringing this
  vulnerability to our attention. :gl:`#6357`

- Out-of-zone records in a zone database could be served as
  authoritative. :cve:`2026-78301`

  When a zone database contained records for names outside the zone
  such as a delegation above the zone apex, left behind by a secondary
  that had accepted out-of-zone data from its primary  the server could
  treat them as authoritative and answer queries for names inside the
  zone with that out-of-zone data instead of the zone's own. A server
  that was also a resolver could follow such a delegation and cache the
  answers of the server it named, affecting names outside the configured
  zone. Zone database lookups are now confined to names at or below the
  zone's origin.

  ISC would like to thank Henrique Pereira for bringing this
  vulnerability to our attention. :gl:`#6361`

- Fix crash on wildcard answers carrying both NSEC and NSEC3 proofs.
  :cve:`2026-80274`

  When a wildcard answer arrived with both NSEC and NSEC3 records at the
  name proving that the queried name did not exist, the resolver could
  pick different records when caching the answer and when retrieving the
  proof, depending on the order in which the authoritative server sent
  them. This could terminate :iscman:`named` with an assertion failure,
  fail the query with SERVFAIL, or serve a denial record other than the
  one that had been verified. The resolver now caches and serves the
  same denial record it accepted when the answer was received.

  ISC would like to thank hythyt for bringing this vulnerability to our
  attention. :gl:`#6369`

- Following HTTPS/SVCB aliases could leak resolver cache memory.
  :cve:`2026-81563`

  When a recursive server answered a query for an HTTPS or SVCB record
  in alias form and the alias target had more than 13 records, the
  target records were pinned in the cache permanently instead of being
  released once the answer was sent. A remote party who could make the
  server follow such aliases to a steady stream of fresh names could
  grow the cache beyond the configured :any:`max-cache-size` until the
  server was unable to resolve unrelated names. The records are now
  released correctly.

  ISC would like to thank Samy Medjahed/Ap4sh for bringing this
  vulnerability to our attention. :gl:`#6374`

Feature Changes
~~~~~~~~~~~~~~~

- Reject oversized and malformed DNSKEY records up front.

  Oversized RSA key material in a DNSKEY record was only rejected after
  it had been converted, allocating memory proportional to the record
  size. Such records are now rejected before conversion, as are Ed25519
  and Ed448 keys with trailing bytes that were previously silently
  ignored. :gl:`#4537`

Bug Fixes
~~~~~~~~~

- Prevent a crash when using both :any:`dns64` and ``filter-a``.

  An assertion failure was possible when using both :any:`dns64` and the
  ``filter-a`` plugin simultaneously; this has been fixed.
  :gl:`#5979`

- Stop passing UDP client addresses to :any:`update-policy` ``external``
  helpers.

  Dynamic update rules of type ``external`` delegate the authorization
  decision to an external helper daemon. The client address field in
  the helper request is only meant to carry TCP client addresses, which
  cannot easily be spoofed, but UDP client addresses were passed as
  well, so the helper could base its decision on an untrustworthy
  address. For updates arriving over UDP, the helper request no longer
  includes a client address. :gl:`#6061`

- Missing required NSEC3 for delegation not detected.

  A missing required NSEC3 record for an insecure delegation in a
  non-opt-out range was not being detected. This has been fixed.
  :gl:`#6063`

- Tighten EUI48 and EUI64 text parsing.

  Malformed EUI48 and EUI64 records could be accepted. This has been
  fixed. :gl:`#6082`

- GeoIP ACL state could be stale or wrong after reload.

  Previously, :iscman:`named` cached GeoIP information after looking it
  up, but the cached information was not invalidated when the GeoIP
  database was reloaded, so it could continue to be used. Existing
  cached GeoIP information is now invalidated as part of the reloading
  process. :gl:`#6083`

- Honor DNSSEC policy key tag ranges.

  When a :any:`dnssec-policy` configured a non-default ``tag-range``,
  :iscman:`dnssec-keygen` and :iscman:`dnssec-ksr` could accept
  generated keys outside that range. Both tools now honor the configured
  minimum and maximum key tags. :gl:`#6091`

- Fix a double free in :iscman:`mdig` when EDNS options are specified.

  The :iscman:`mdig` utility could terminate with a double free when
  EDNS options were specified on the command line. This has been fixed.
  :gl:`#6095`

- Fix a crash when an IXFR falls back to AXFR with updates still
  pending.

  When a secondary zone received an incremental transfer (IXFR) and the
  primary then caused :iscman:`named` to fall back to a full transfer
  (AXFR) while some of the already-received incremental changes were
  still waiting to be applied, :iscman:`named` could later crash when
  that transfer finished. The pending changes are now discarded
  correctly before the AXFR retry. :gl:`#6114`

- Fix DS requests to parental agents over TLS.

  TLS configuration for parental agents was being ignored when sending
  DS requests. This has been fixed. :gl:`#6135`

- Fix the :option:`rndc-confgen -q` (quiet) option.

  The command-line parsing in :iscman:`rndc-confgen` was broken, so
  :option:`rndc-confgen -q` did not work. This has been fixed.
  :gl:`#6187`

- Enforce query ACLs for redirect zones and searched DLZs.

  Queries answered from redirect zones or searched DLZ databases did not
  consistently honor :any:`allow-query` and :any:`allow-query-on`,
  potentially exposing restricted DNS data to excluded clients or
  through excluded listening addresses. These ACLs are now enforced
  before redirect or DLZ data is returned. :gl:`#6251` :gl:`#6252`

- Check ``asnum`` validity in GeoIP ACLs.

  The validity of autonomous system (AS) numbers is now checked at
  configuration time when parsing GeoIP ACLs that use ``asnum``
  elements.

  ``asnum`` values start with an optional case-insensitive ``AS``
  prefix, followed only by decimal digits, with no spaces or other
  extraneous characters. The value represented cannot exceed 2^32.
  :gl:`#6255`

- Fix a crash on :any:`remote-servers` lists that reference themselves.

  Since 9.21.16 and 9.20.17, a :any:`remote-servers`, :any:`primaries`,
  ``masters``, or :any:`parental-agents` list that referenced itself,
  directly or through another list, made :iscman:`named` crash on
  startup or reconfiguration. Such references are again skipped and the
  remaining entries in the list are used, as in earlier versions.
  :gl:`#6287`

- A record from outside a response policy zone could crash
  :iscman:`named`.

  A response policy zone transferred from a primary can contain a record
  whose name lies outside the zone. Such a record could terminate
  :iscman:`named` with an assertion failure, both when it arrived and
  again at every startup afterwards, because a secondary keeps it in its
  own copy of the zone. Records like this are now rejected and logged;
  previously one could also silently create a policy entry for an
  unrelated name. :gl:`#6304`

- Invalid :any:`key-store` configuration could abort the DNSSEC tools.

  An invalid :any:`key-store` block named ``key-directory`` in a
  configuration file could abort the DNSSEC tools. This has been fixed.
  :gl:`#6313`

- NSEC signature set could bypass the secure-delegation check.

  When proving that a delegation was insecure, the validator bounded an
  NSEC record's authority by the signer of whichever RRSIG happened to
  come first in the record's signature set, rather than the signature
  that actually verified. A grandparent NSEC padded with an extra,
  unverifiable signature could therefore pass the check that kept such
  proofs from reaching below a signed child zone. The validator now
  requires every signature on the NSEC to name the same signer and
  refuses proofs whose signature set is malformed or larger than
  :any:`max-validations-per-fetch` allows. :gl:`#6321`

- Fix a possible :iscman:`nsupdate` issue when using GSS-TSIG.

  The :iscman:`nsupdate` process could terminate unexpectedly when using
  the GSS-TSIG mode executed with the :option:`nsupdate -g` option. This
  has been fixed. :gl:`#6325`

- Fix a crash with a single-element ``geoip`` sortlist.

  If :iscman:`named` was configured with a single-element
  :any:`sortlist` containing a ``geoip`` ACL element, any matching query
  triggered an assertion failure. This has been fixed. :gl:`#6342`

- Prevent out-of-bailiwick CNAMEs from evicting cached records.

  A recursive resolver could remove valid cached records when a DNS
  response contained an out-of-bailiwick CNAME with the same owner name.
  Out-of-bailiwick data is now discarded before it can modify the cache.
  :gl:`#6345`

- Restore periodic cleanup of stale resolver address data.

  Stale resolver address data could remain cached until memory pressure
  or an explicit flush. The cleanup interval has been corrected, so
  stale entries are removed periodically again. :gl:`#6346`

- Fix :iscman:`named-checkconf`/:iscman:`named` crash with malformed
  key name.

  When a primary/remote-server key name was malformed,
  :iscman:`named-checkconf` and :iscman:`named` were both crashing
  (after warning about the invalid key name). This is now fixed.
  :gl:`#6362`

- Prevent resolver crashes while processing DNS over TCP.

  Recursive resolvers could terminate with an assertion failure while
  processing DNS responses over TCP under sustained traffic. The failure
  was observed on resolvers configured globally with ``forward only;``,
  but the same transport path is also used by iterative resolution.
  This has been fixed. :gl:`!12537`