head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC6:1.1.1.1.2.1 bind-9-20-24:1.1.1.2 netbsd-11-0-RC5:1.1.1.1 bind-9-20-23:1.1.1.2 netbsd-11-0-RC4:1.1.1.1 bind-9-20-22:1.1.1.1 netbsd-11-0-RC3:1.1.1.1 netbsd-11-0-RC2:1.1.1.1 netbsd-11-0-RC1:1.1.1.1 bind-9-20-18:1.1.1.1 perseant-exfatfs:1.1.1.1.0.4 perseant-exfatfs-base-20250801:1.1.1.1 netbsd-11:1.1.1.1.0.2 netbsd-11-base:1.1.1.1 bind-9-20-11:1.1.1.1 ISC:1.1.1; locks; strict; comment @# @; 1.1 date 2025.07.17.18.27.06; author christos; state Exp; branches 1.1.1.1; next ; commitid gnYzoA8O0EXIW73G; 1.1.1.1 date 2025.07.17.18.27.06; author christos; state Exp; branches 1.1.1.1.2.1 1.1.1.1.4.1; next 1.1.1.2; commitid gnYzoA8O0EXIW73G; 1.1.1.2 date 2026.05.20.16.42.58; author christos; state Exp; branches; next ; commitid 8F4FGV2ey5ZbCzGG; 1.1.1.1.2.1 date 2026.06.27.10.14.04; author martin; state Exp; branches; next ; commitid kM4MXv6L08MweqLG; 1.1.1.1.4.1 date 2025.07.17.18.27.06; author perseant; state dead; branches; next 1.1.1.1.4.2; commitid 23j6GFaDws3O875G; 1.1.1.1.4.2 date 2025.08.02.05.51.36; author perseant; state Exp; branches; next ; commitid 23j6GFaDws3O875G; desc @@ 1.1 log @Initial revision @ text @; Copyright (C) Internet Systems Consortium, Inc. ("ISC") ; ; SPDX-License-Identifier: MPL-2.0 ; ; This Source Code Form is subject to the terms of the Mozilla Public ; License, v. 2.0. If a copy of the MPL was not distributed with this ; file, you can obtain one at https://mozilla.org/MPL/2.0/. ; ; See the COPYRIGHT file distributed with this work for additional ; information regarding copyright ownership. $TTL 999999 . IN NS a.root-servers.nil. a.root-servers.nil. IN A 10.53.0.1 a.root-servers.nil. AAAA fd92:7065:b8e:ffff::1 @ 1.1.1.1 log @Import bind 9.20.11 (previous was 9.20.9) Changes: BIND 9.20.11 Security Fixes [CVE-2025-40777] Fix a possible assertion failure when using the 'stale-answer-client-timeout 0' option. 055a592fd97 In specific circumstances the named resolver process could terminate unexpectedly when stale answers were enabled and the stale-answer-client-timeout 0 configuration option was used. This has been fixed. [GL #5372] New Features Add support for the CO flag to dig. 47108af9f2e Add support to display the CO (Compact Answers OK flag) when displaying messages. Add support to set the CO flag when making queries in dig (+coflag). [GL #5319] [GL !10578] Bug Fixes Fix the default interface-interval from 60s to 60m. e8ffe3a15ca When the interface-interval parser was changed from uint32 parser to duration parser, the default value stayed at plain number 60 which now means 60 seconds instead of 60 minutes. The documentation also incorrectly states that the value is in minutes. That has been fixed. [GL #5246] [GL !10679] Fix purge-keys bug when using views. 35efa742b03 Previously, when a DNSSEC key was purged by one zone view, other zone views would return an error about missing key files. This has been fixed. [GL #5315] [GL !10598] Use IPv6 queries in delv +ns. 4916fe0c6bd delv +ns invokes the same code to perform name resolution as named, but it neglected to set up an IPv6 dispatch object first. Consequently, it was behaving more like named -4. It now sets up dispatch objects for both address families, and performs resolver queries to both v4 and v6 addresses, except when one of the address families has been suppressed by using delv -4 or delv -6. [GL #5352] [GL !10573] BIND 9.20.10 New Features Implement a new 'notify-defer' configuration option. a24db6433e6 This new option sets a delay (in seconds) to wait before sending a set of NOTIFY messages for a zone. Whenever a NOTIFY message is ready to be sent, sending will be deferred for this duration. This option is not to be confused with the notify-delay option. The default is 0 seconds. [GL #5259] [GL !10465] Removed Features Implement the systemd notification protocol manually to remove dependency on libsystemd. 4f7e806a12b libsystemd, despite being useful, adds a huge surface area for just using the sd_notify API. libsystemd's surface has been exploited in the past [1]. Implement the systemd notification protocol by hand since it is just sending newline-delimited datagrams to a UNIX socket. The code shouldn't need more attention in the future since the notification protocol is covered under systemd's stability promise [2]. We don't need to support VSOCK-backed service notifications since they are only intended for virtual machine inits. [1]: https://www.openwall.com/lists/oss-security/2024/03/29/4 [2]: https://systemd.io/PORTABILITY_AND_STABILITY/ [GL !10454] Bug Fixes Fix zone deletion issue. 66fc4ee86e0 A secondary zone could initiate a new zone transfer from the primary server after it had been already deleted from the secondary server, and before the internal garbage collection was activated to clean it up completely. This has been fixed. [GL #5291] [GL !10496] Fix a zone refresh bug. f09bb8b88c6 A secondary zone could fail to further refresh with new versions of the zone from a primary server if named was reconfigured during the SOA request step of an ongoing zone transfer. This has been fixed. [GL #5307] [GL !10495] Allow keystore.c to compile on Solaris. 108adab25a0 keystore.c failed to compile on Solaris because NAME_MAX was undefined. Include which defines NAME_MAX for platforms that don't define it. [GL #5327] [GL !10523] Set name for all the isc_mem contexts. bdcd698edf7 [GL !10498] @ text @@ 1.1.1.1.2.1 log @Pull up the following, requested by christos in ticket #315: external/mpl/bind/dist/bin/tests/system/class/ns1/chaos.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/ns2/example.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/ns2/localhost.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/ns2/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/setup.sh up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/tests_class_chaos.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/tests_class_update.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/class/ns3/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/cap_glues/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/cap_glues/ns1/root.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/cap_glues/ns2/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/cap_glues/ns2/tld.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/cap_glues/tests_cap_glues.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/cap_glues/ns3/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/cap_glues/ns3/root.hint up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/catz/ns1/catalog-bad6.example.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/checkconf/warn-chaos-recursion.conf up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/checkconf/inline-inherit.conf up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/zones/delegations.partial.db.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/zones/ns.partial.db.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/zones/root.db.j2.manual up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/zones/soa.partial.db.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/zones/template.db.j2.manual up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/controls.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/root.hint.conf up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/_common/zones.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec/signer/general/test13.zone up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/masterformat/ns2/named.args up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/nsupdate/ans11/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/nsupdate/tests_update_sig.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns10/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns10/redirect.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns10/root.hints up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns7/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns7/redirect.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns7/root.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns8/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns8/root.hints up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/tests_redirect_dns64.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns9/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns9/redirect.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns9/root.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/redirect/ns9/sign.sh up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tcp/ns2/named.args up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tcp/ns3/named.args up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tcp/ns4/named.args up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tcp/ns5/named.args up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/xfer/ans5/ans.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/xfer/ans11/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/xferquota/ns3/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/xferquota/ns3/quota.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/xferquota/ns3/root.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dispatch/ans4/tcp-only.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dispatch/ans4/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dispatch/tests_tcponly.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/kasp/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/kasp/ns1/root.db.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/kasp/ns1/setup.sh up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dns64_dname/ns1/hack.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dns64_dname/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dns64_dname/ns1/root.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dns64_dname/ns2/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dns64_dname/ns2/root.hint up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dns64_dname/tests_dns64_dname.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_cname_response/ans2/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_cname_response/ans2/example.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_cname_response/ans2/secure.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_cname_response/tests_cname_rejection.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_cname_response/ns3/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_cname_response/ns3/trusted.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-active.selfsigned.db.signed up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-revoked.selfsigned.db.signed up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/doth/tests_malicious.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/isctest/transfer.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/nsec_ixfr/ns1/example.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/nsec_ixfr/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/nsec_ixfr/ns2/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/nsec_ixfr/setup.sh up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/nsec_ixfr/tests_nsec_ixfr.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/resend_loop/ans3/ans.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/resend_loop/tests_resend_loop.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/resend_loop/ns4/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/resend_loop/ns4/root.hint up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/rndc_confgen/tests_rndc_confgen.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/mismatchtcp/ans2/example.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/mismatchtcp/ans2/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/mismatchtcp/tests_mismatchtcp.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/mismatchtcp/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/mismatchtcp/ns1/root.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/qpcache_rrsig_any/ans3/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/qpcache_rrsig_any/tests_qpcache_rrsig_any.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/qpcache_rrsig_any/ns2/named.args up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/qpcache_rrsig_any/ns2/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns1/root.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns2/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns2/tld.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/tests_selfpointedglue.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns3/example.tld.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns3/example2.tld.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns3/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns4/named.args.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns4/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/selfpointedglue/ns4/root.hint up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/srtt_ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/README up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ans2/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/tests_srtt.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ans3/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ans4/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ans5/ans.py up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ns1/root.db up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ns6/named.args up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/srtt/ns6/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tkeyleak/ns1/dns.keytab up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tkeyleak/ns1/example.db.in up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tkeyleak/ns1/named.conf.j2 up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tkeyleak/prereq.sh up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tkeyleak/setup.sh up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/tkeyleak/tests_tkeyleak.py up to 1.1.1.1 external/mpl/bind/dist/doc/notes/notes-9.20.23.rst up to 1.1.1.2 external/mpl/bind/dist/doc/notes/notes-9.20.24.rst up to 1.1.1.1 external/mpl/bind/dist/doc/changelog/changelog-9.20.23.rst up to 1.1.1.1 external/mpl/bind/dist/doc/changelog/changelog-9.20.24.rst up to 1.1.1.1 external/mpl/bind/dist/bin/tests/system/ans.pl delete external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated.selfsigned.db.signed delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/badkeydata delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/badmessageid delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/ednsformerr delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/ednsnotimp delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/goodaxfr delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/ixfrnotimp delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/partial delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/soamismatch delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/unknownkey delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/unsigned delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/wrongkey delete external/mpl/bind/dist/bin/tests/system/xfer/ans5/wrongname delete external/mpl/bind/dist/CONTRIBUTING.md up to 1.1.1.11 external/mpl/bind/dist/NEWS up to 1.1.1.9 external/mpl/bind/dist/configure up to 1.25 external/mpl/bind/dist/configure.ac up to 1.1.1.23 external/mpl/bind/dist/srcid up to 1.1.1.24 external/mpl/bind/dist/bin/check/check-tool.c up to 1.13 external/mpl/bind/dist/bin/confgen/keygen.c up to 1.9 external/mpl/bind/dist/bin/delv/delv.c up to 1.20 external/mpl/bind/dist/bin/dnssec/dnssec-keygen.c up to 1.17 external/mpl/bind/dist/bin/dnssec/dnssec-ksr.c up to 1.6 external/mpl/bind/dist/bin/dnssec/dnssec-signzone.c up to 1.18 external/mpl/bind/dist/bin/dnssec/dnssec-verify.c up to 1.11 external/mpl/bind/dist/bin/named/bind9.xsl up to 1.1.1.13 external/mpl/bind/dist/bin/named/controlconf.c up to 1.15 external/mpl/bind/dist/bin/named/main.c up to 1.24 external/mpl/bind/dist/bin/named/server.c up to 1.29 external/mpl/bind/dist/bin/named/statschannel.c up to 1.20 external/mpl/bind/dist/bin/nsupdate/nsupdate.rst up to 1.1.1.7 external/mpl/bind/dist/bin/tests/system/conftest.py up to 1.1.1.9 external/mpl/bind/dist/bin/tests/system/feature-test.c up to 1.15 external/mpl/bind/dist/bin/tests/system/packet.pl up to 1.1.1.5 external/mpl/bind/dist/bin/tests/system/requirements.txt up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/start.pl up to 1.1.1.13 external/mpl/bind/dist/bin/tests/system/_common/controls.conf.in up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/_common/rndc.conf up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/_common/rndc.key up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/_common/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/_common/root.hint.blackhole up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/_common/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/additional/ns3/root.hint up to 1.1.1.4 external/mpl/bind/dist/bin/tests/system/allow_query/tests.sh up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/tests_sh_allow_query.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/controls.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named02.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named03.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named04.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named05.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named06.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named07.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named08.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named09.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named10.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named11.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named12.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named21.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named22.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named23.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named24.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named25.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named26.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named27.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named28.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named29.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named30.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named31.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named32.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named33.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named34.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named40.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named53.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named54.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named55.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named56.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/allow_query/ns2/named57.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/catz/tests.sh up to 1.1.1.14 external/mpl/bind/dist/bin/tests/system/catz/ns1/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/catz/ns2/named.conf.j2 up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/chain/ns7/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/checkconf/tests.sh up to 1.1.1.15 external/mpl/bind/dist/bin/tests/system/checkds/tests_checkds.py up to 1.1.1.8 external/mpl/bind/dist/bin/tests/system/checknames/ns2/root.hints up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/checknames/ns3/root.hints up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/checknames/ns4/root.hints up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/checknames/ns5/root.hints up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/cipher_suites/tests_cipher_suites.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/cookie/cookie_ans.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/cookie/ns1/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/cookie/ns3/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/cookie/ns4/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/cookie/ns5/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/cookie/ns6/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/dialup/tests_dialup_zone_transfer.py up to 1.1.1.5 external/mpl/bind/dist/bin/tests/system/digdelv/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/digdelv/tests.sh up to 1.1.1.20 external/mpl/bind/dist/bin/tests/system/dispatch/ns1/root.db up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/dnssec/tests.sh up to 1.1.1.18 external/mpl/bind/dist/bin/tests/system/dnssec/tests_sh_dnssec.py up to 1.1.1.6 external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/tests_malformed_dnskey.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/ns2/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/ns2/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/ns3/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/dnssec_malformed_dnskey/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/emptyzones/ns1/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/expiredglue/ns4/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/fetchlimit/ns3/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/fetchlimit/ns5/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/filters/tests_filter_dns64.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/filters/ns1/unsigned.db up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/filters/ns4/unsigned.db up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/filters/ns5/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/isctest/__init__.py up to 1.1.1.7 external/mpl/bind/dist/bin/tests/system/isctest/asyncserver.py up to 1.1.1.7 external/mpl/bind/dist/bin/tests/system/isctest/check.py up to 1.1.1.7 external/mpl/bind/dist/bin/tests/system/isctest/kasp.py up to 1.1.1.6 external/mpl/bind/dist/bin/tests/system/isctest/mark.py up to 1.1.1.7 external/mpl/bind/dist/bin/tests/system/isctest/query.py up to 1.1.1.9 external/mpl/bind/dist/bin/tests/system/isctest/template.py up to 1.1.1.5 external/mpl/bind/dist/bin/tests/system/isctest/vars/features.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/ixfr/ans2/ans.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/kasp/setup.sh up to 1.1.1.9 external/mpl/bind/dist/bin/tests/system/kasp/tests_kasp.py up to 1.1.1.5 external/mpl/bind/dist/bin/tests/system/ksr/tests_ksr.py up to 1.1.1.6 external/mpl/bind/dist/bin/tests/system/ksr/ns1/named.conf.j2 up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/ksr/ns1/setup.sh up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/mirror_root_zone/tests_mirror_root_zone.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/nsec/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/nsec3_delegation/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/nsprocessinglimit/ns4/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/nsupdate/setup.sh up to 1.1.1.12 external/mpl/bind/dist/bin/tests/system/nsupdate/tests.sh up to 1.1.1.18 external/mpl/bind/dist/bin/tests/system/nsupdate/tests_sh_nsupdate.py up to 1.1.1.6 external/mpl/bind/dist/bin/tests/system/nsupdate/ns6/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/optout/tests_optout.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/optout/ns2/controls.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/optout/ns2/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/query_source/ns2/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/query_source/ns3/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/query_source/ns4/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/query_source/ns5/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/reclimit/tests.sh up to 1.1.1.10 external/mpl/bind/dist/bin/tests/system/redirect/setup.sh up to 1.1.1.9 external/mpl/bind/dist/bin/tests/system/redirect/tests.sh up to 1.1.1.8 external/mpl/bind/dist/bin/tests/system/redirect/tests_sh_redirect.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/redirect/ns4/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/resolver/tests.sh up to 1.1.1.15 external/mpl/bind/dist/bin/tests/system/resolver/ns1/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/resolver/ns5/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/resolver/ns7/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/resolver/ns9/root.hint up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover/setup.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/rollover/tests_rollover_manual.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/rollover/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_algo_csk/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_algo_ksk_zsk/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_csk_roll1/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_csk_roll2/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_enable_dnssec/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_going_insecure/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_ksk_3crowd/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_ksk_doubleksk/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_straight2none/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rollover_zsk_prepub/ns3/trusted.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/rpz/testlib/test-data.c up to 1.4 external/mpl/bind/dist/bin/tests/system/rpzrecurse/ns2/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/serve_stale/tests.sh up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/tests_sh_serve_stale.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns1/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns1/named4.conf.in up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named1.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named2.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named3.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named4.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named5.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named6.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named7.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/serve_stale/ns3/named9.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/statistics/ns3/root.hint up to 1.1.1.4 external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns2/root.hints up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns3/root.hints up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns4/root.hints up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns5/root.hints up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/synthfromdnssec/ns6/root.hints up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/unknown/tests.sh up to 1.1.1.8 external/mpl/bind/dist/bin/tests/system/xfer/tests_retransfer_with_force.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/xfer/tests_xfer.py up to 1.1.1.3 external/mpl/bind/dist/bin/tests/system/xfer/ns6/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/xfer/ns8/small.db.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/xfer_servers_list/tests_xfer_servers_list.py up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/xferquota/tests_xferquota.py up to 1.1.1.7 external/mpl/bind/dist/bin/tests/system/xferquota/ns1/named.conf.j2 up to 1.1.1.2 external/mpl/bind/dist/bin/tests/system/zero/ns3/root.hint up to 1.1.1.3 external/mpl/bind/dist/bin/tools/nsec3hash.c up to 1.10 external/mpl/bind/dist/doc/arm/changelog.rst up to 1.1.1.8 external/mpl/bind/dist/doc/arm/conf.py up to 1.1.1.11 external/mpl/bind/dist/doc/arm/isc-logo.pdf up to 1.6 external/mpl/bind/dist/doc/arm/notes.rst up to 1.1.1.16 external/mpl/bind/dist/doc/arm/platforms.inc.rst up to 1.1.1.7 external/mpl/bind/dist/doc/dnssec-guide/img/remove-ds-2.png up to 1.2 external/mpl/bind/dist/doc/man/nsupdate.1in up to 1.1.1.11 external/mpl/bind/dist/lib/dns/adb.c up to 1.18 external/mpl/bind/dist/lib/dns/catz.c up to 1.18 external/mpl/bind/dist/lib/dns/db.c up to 1.15 external/mpl/bind/dist/lib/dns/diff.c up to 1.14 external/mpl/bind/dist/lib/dns/dispatch.c up to 1.16 external/mpl/bind/dist/lib/dns/dns64.c up to 1.9 external/mpl/bind/dist/lib/dns/dnssec.c up to 1.20 external/mpl/bind/dist/lib/dns/dst_api.c up to 1.19 external/mpl/bind/dist/lib/dns/gssapictx.c up to 1.14 external/mpl/bind/dist/lib/dns/hmac_link.c up to 1.11 external/mpl/bind/dist/lib/dns/master.c up to 1.16 external/mpl/bind/dist/lib/dns/masterdump.c up to 1.20 external/mpl/bind/dist/lib/dns/message.c up to 1.24 external/mpl/bind/dist/lib/dns/name.c up to 1.17 external/mpl/bind/dist/lib/dns/nta.c up to 1.15 external/mpl/bind/dist/lib/dns/opensslrsa_link.c up to 1.14 external/mpl/bind/dist/lib/dns/qp.c up to 1.6 external/mpl/bind/dist/lib/dns/qp_p.h up to 1.4 external/mpl/bind/dist/lib/dns/qpcache.c up to 1.7 external/mpl/bind/dist/lib/dns/qpzone.c up to 1.7 external/mpl/bind/dist/lib/dns/rdataslab.c up to 1.14 external/mpl/bind/dist/lib/dns/request.c up to 1.15 external/mpl/bind/dist/lib/dns/resolver.c up to 1.27 external/mpl/bind/dist/lib/dns/rpz.c up to 1.19 external/mpl/bind/dist/lib/dns/rrl.c up to 1.14 external/mpl/bind/dist/lib/dns/tkey.c up to 1.19 external/mpl/bind/dist/lib/dns/tsig.c up to 1.16 external/mpl/bind/dist/lib/dns/validator.c up to 1.22 external/mpl/bind/dist/lib/dns/xfrin.c up to 1.23 external/mpl/bind/dist/lib/dns/zone.c up to 1.28 external/mpl/bind/dist/lib/dns/zoneverify.c up to 1.14 external/mpl/bind/dist/lib/dns/include/dns/adb.h up to 1.12 external/mpl/bind/dist/lib/dns/include/dns/compress.h up to 1.9 external/mpl/bind/dist/lib/dns/include/dns/db.h up to 1.16 external/mpl/bind/dist/lib/dns/include/dns/diff.h up to 1.10 external/mpl/bind/dist/lib/dns/include/dns/dispatch.h up to 1.10 external/mpl/bind/dist/lib/dns/include/dns/keyvalues.h up to 1.11 external/mpl/bind/dist/lib/dns/include/dns/nametree.h up to 1.3 external/mpl/bind/dist/lib/dns/include/dns/nsec.h up to 1.9 external/mpl/bind/dist/lib/dns/include/dns/qp.h up to 1.5 external/mpl/bind/dist/lib/dns/include/dns/sdlz.h up to 1.10 external/mpl/bind/dist/lib/dns/include/dns/ssu.h up to 1.9 external/mpl/bind/dist/lib/dns/include/dns/stats.h up to 1.10 external/mpl/bind/dist/lib/dns/include/dns/tsig.h up to 1.11 external/mpl/bind/dist/lib/dns/include/dns/zone.h up to 1.17 external/mpl/bind/dist/lib/dns/include/dst/gssapi.h up to 1.10 external/mpl/bind/dist/lib/dns/rdata/in_1/a_1.c up to 1.13 external/mpl/bind/dist/lib/isc/histo.c up to 1.4 external/mpl/bind/dist/lib/isc/ht.c up to 1.12 external/mpl/bind/dist/lib/isc/mem.c up to 1.20 external/mpl/bind/dist/lib/isc/picohttpparser.c up to 1.7 external/mpl/bind/dist/lib/isc/ratelimiter.c up to 1.11 external/mpl/bind/dist/lib/isc/result.c up to 1.16 external/mpl/bind/dist/lib/isc/tls.c up to 1.9 external/mpl/bind/dist/lib/isc/include/isc/hmac.h up to 1.8 external/mpl/bind/dist/lib/isc/include/isc/result.h up to 1.15 external/mpl/bind/dist/lib/isc/include/isc/stdio.h up to 1.8 external/mpl/bind/dist/lib/isc/include/isc/tls.h up to 1.6 external/mpl/bind/dist/lib/isc/netmgr/http.c up to 1.9 external/mpl/bind/dist/lib/isc/netmgr/tcp.c up to 1.15 external/mpl/bind/dist/lib/isccfg/check.c up to 1.7 external/mpl/bind/dist/lib/isccfg/include/isccfg/aclconf.h up to 1.10 external/mpl/bind/dist/lib/ns/client.c up to 1.29 external/mpl/bind/dist/lib/ns/query.c up to 1.29 external/mpl/bind/dist/lib/ns/update.c up to 1.21 external/mpl/bind/dist/lib/ns/xfrout.c up to 1.18 external/mpl/bind/dist/tests/dns/dispatch_test.c up to 1.5 external/mpl/bind/dist/tests/dns/dnstap_test.c up to 1.5 external/mpl/bind/dist/tests/dns/qpdb_test.c up to 1.4 external/mpl/bind/dist/tests/dns/rsa_test.c up to 1.4 external/mpl/bind/dist/tests/dns/tsig_test.c up to 1.8 external/mpl/bind/dist/tests/dns/update_test.c up to 1.5 external/mpl/bind/dist/tests/isc/mem_test.c up to 1.6 external/mpl/bind/dist/tests/isc/time_test.c up to 1.4 external/mpl/bind/include/config.h up to 1.28 external/mpl/bind/lib/libdns/dns.common.expsym up to 1.9 external/mpl/bind/lib/libdns/shlib_version up to 1.21 distrib/sets/lists/base/shl.mi (manually edited) distrib/sets/lists/debug/shl.mi (manually edited) doc/3RDPARTY (manually edited) Import bind 9.20.24/MPL @ text @d1 11 @ 1.1.1.2 log @ Import bind 9.20.23 (previous was 9.20.22) Security Fixes Limit resolver server list size. (CVE-2026-3592) When resolving a domain with many nameservers that shared overlapping IP addresses (e.g., 10 NS records all pointing at the same set of addresses), BIND could previously waste time querying duplicate addresses and build up excessively large server lists. Addresses in the resolver's server list are now deduplicated so that each unique IP is only queried once per resolution attempt, regardless of how many NS records point to it. The number of addresses stored per nameserver name is also now capped at six (combined A and AAAA), preventing memory and CPU overhead from domains with unusually large NS/glue sets. ISC would like to thank Shuhan Zhang from Tsinghua University for reporting this issue. [GL #5641] Fix GSS-API resource leak. (CVE-2026-3039) A memory leak was fixed where each GSS-API TKEY negotiation leaked a security context inside the GSS library. An unauthenticated attacker could exhaust server memory by sending repeated TKEY queries to a server with tkey-gssapi-keytab configured. The leaked memory was allocated by the GSS library, bypassing BIND's memory accounting. Multi-round GSS-API negotiation (GSS_S_CONTINUE_NEEDED) is now rejected, as BIND never supported it correctly and Kerberos/SPNEGO completes in a single round. ISC would like to thank Vitaly Simonovich for bringing this vulnerability to our attention. [GL #5752] Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) Recursion, dynamic updates (UPDATE), and zone change notifications (NOTIFY) are now disabled for views with a class other than IN (such as CHAOS or HESIOD); authoritative service for non-IN zones (e.g. version.bind in class CHAOS) continues to work as before. Servers configured with recursion yes; in a non-IN view log a warning at startup, and named-checkconf flags the same condition. UPDATE and NOTIFY messages that specify the meta-classes ANY or NONE in the question section are now rejected with FORMERR. This addresses a set of closely related security issues collectively identified as CVE-2026-5946. ISC would like to thank Mcsky23 for bringing these issues to our attention. [GL #5784] Avoid unbounded recursion loop. (CVE-2026-5950) A bug during bad server handling could cause the resolver to enter an infinite loop, continuously sending queries to an upstream server with no exit condition, until the resolver query timeout was hit. This has been fixed. ISC would like to thank Billy Baraja (BielraX) for bringing this issue to our attention. [GL #5804] dfmt: Command not found. A resolver could crash when handling a SIG(0)-signed response if the matching client query was cancelled while signature verification was still in progress for example, when the recursive-clients quota was exhausted. This has been fixed. ISC would like to thank Naoki Wakamatsu for bringing this vulnerability to our attention. [GL #5819] Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593) Previously, a use-after-free vulnerability in the DNS-over-HTTPS implementation could cause named to crash when a client sent a flood of HTTP/2 SETTINGS frames while a DoH response was being written. This affected servers with DoH (DNS-over-HTTPS) enabled and has been fixed. ISC would like to thank Naresh Kandula Parmar (Nottiboy) for reporting this. [GL #5755] Fix outgoing zone transfers' quota issue. Unauthorized clients could consume the entire outgoing zone-transfer quota and block authorized zone transfer clients. This has been fixed. [GL #3589] Feature Changes Fix CPU spikes and slow queries when cache approaches memory limit. Cache cleanup is now spread probabilistically to avoid CPU usage spikes and a drop in query throughput. [GL #5891] Bug Fixes Use the zone file's basename as origin in DNSSEC tools. In dnssec-signzone and dnssec-verify, when the zone origin is not specified using the -o parameter, the default behavior is to try to sign using the zone's file name as the origin. So, for example, dnssec-signzone -S example.com will work, so long as the file name matches the zone name. This now also works if the zone is in a different directory. For example, dnssec-signzone -S zones/example.com will set the origin value to example.com. [GL #5678] Fix a possible race condition during zone transfers. The named process could terminate unexpectedly when processing an IXFR message during a zone transfer. This has been fixed. [GL #5767] Fix named crash when processing SIG records in dynamic updates. Previously, named could abort if a client sent a dynamic update containing a SIG record (the legacy signature type) to a zone configured with an update-policy. The function dns_db_findrdataset had an incorrect requirements prerequisite that prevented SIG records from being looked up, which was triggered as part of processing an UPDATE request and could be triggered remotely by any client permitted to send updates. This has been fixed by ensuring that SIG records are handled consistently with RRSIG records during update processing. [GL #5818] Fix rndc modzone behavior for a zone in named.conf. If a zone was present in the configuration file and not originally added by rndc addzone, rndc modzone for that zone would succeed once but subsequent rndc modzone attempts would fail. This has been fixed. [GL #5826] Fix zone verification of NSEC3 signed zones. Previously, when computing the compressed bitmap during verification of an NSEC3-signed zone, an undersized buffer was used that resulted in an out-of-bounds write if there were too many active windows in the bitmap. This impacted the mirror zones which are NSEC3-signed, dnssec-signzone and dnssec-verify. This has been fixed. [GL #5834] Prevent a crash when using both dns64 and filter-aaaa. An assertion failure could be triggered if both dns64 and the filter-aaaa plugin were in use simultaneously. This happened if the plugin triggered a second recursion process, which then attempted to store DNS64 state information in a pointer that had already been set by the original recursion process. This has been fixed. [GL #5854] Fixed an assertion failure when processing catalog zones. If a TXT record containing an invalid name TSIG key name was found when processing a catalog zone member's primaries definition, dns_name_free was incorrectly called, triggering an assertion. This has been fixed. [GL #5858] Prevent malicious DNSSEC zones from exhausting validator CPU. A DNSSEC-signed zone could publish a DNSKEY with an unusually large RSA public exponent and force any validator resolving names in that zone to spend disproportionate CPU verifying signatures. The validator now rejects such DNSKEYs, matching the limit already applied to keys read from files or HSMs. [GL #5881] Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits. rndc-confgen (with either -A hmac-sha384 or -A hmac-sha512) previously documented a -b range of 1..1024, but any value above 512 aborted on hardened builds instead of producing a key. The full advertised range now works. [GL #5903] Prevent crafted queries from degrading RRL performance. With response rate limiting enabled, an attacker sending queries from many spoofed source addresses could steer entries into the same slot of the internal rate-limit table and slow down query processing on the affected server. The table now uses a per-process keyed hash so the placement of entries cannot be predicted or influenced from the network. [GL #5906] Prevent rare named crash when notifies are cancelled. Under heavy load, named could occasionally crash when a queued outbound notify or zone refresh was cancelled at the moment it was being sent for example, while a zone was being reloaded or removed. The race that caused the crash is now prevented. [GL #5915] Stop delv from aborting on a malformed query name. delv previously aborted with SIGABRT instead of exiting cleanly when given a query name that failed wire-format conversion (e.g. a label longer than 63 octets). After this change delv prints the parse error and exits with a normal failure code. [GL #5916] Fix a crash when reconfiguring while an NTA is being rechecked. Previously, if named was reconfigured or shut down while a negative trust anchor was being rechecked against authoritative servers, the in-flight recheck could outlive the view that owned it and cause named to crash. This has been fixed. [GL #5938] Fix a bug in allow-query/allow-transfer catalog zone custom properties. The named process could terminate unexpectedly when processing a catalog zone with an invalid allow-query or allow-transfer custom property (i.e. having a non-APL type) coexisting with the valid property. This has been fixed. [GL #5941] Fix a memory leak issue in catalog zones. The named process could leak small amounts of memory when processing a catalog zone entry which had defined custom primary servers with TSIG keys, if both the regular primaries custom property syntax and the legacy alternative syntax (masters) were used at the same time. This has been fixed. [GL #5943] Fix suppressed missing-glue check in named-checkzone. named-checkzone and named-checkconf -z silently skipped the missing-glue check for any NS name that had already triggered an extra-AAAA-glue warning, so zones missing required A glue could pass validation and be deployed with broken delegations. [GL !11899] Implement seamless outgoing TCP connection reuse. The resolver can and will reuse outgoing TCP connections to the same host, as recommended by RFC 7766. This prevents a whole class of attacks that abuse the fact that establishing a TCP connection is expensive and it is fairly easy to deplete the outgoing TCP ports by putting them into TIME_WAIT state. The number of pipelined queries per connection is capped at 256 to limit the impact of a connection drop. [GL !11845] Reject record sets too large to serve in DNS. When BIND was asked to store a record set whose total size exceeded what fit in a DNS message, it would allocate memory and build the structure, then fail later at response time. Such oversized record sets are now rejected at the time of storage with an error, avoiding wasted work on data that can never be served. [GL !11963] @ text @d1 11 @ 1.1.1.1.4.1 log @file root.hint was added on branch perseant-exfatfs on 2025-08-02 05:51:36 +0000 @ text @d1 15 @ 1.1.1.1.4.2 log @Sync with HEAD @ text @a0 15 ; Copyright (C) Internet Systems Consortium, Inc. ("ISC") ; ; SPDX-License-Identifier: MPL-2.0 ; ; This Source Code Form is subject to the terms of the Mozilla Public ; License, v. 2.0. If a copy of the MPL was not distributed with this ; file, you can obtain one at https://mozilla.org/MPL/2.0/. ; ; See the COPYRIGHT file distributed with this work for additional ; information regarding copyright ownership. $TTL 999999 . IN NS a.root-servers.nil. a.root-servers.nil. IN A 10.53.0.1 a.root-servers.nil. AAAA fd92:7065:b8e:ffff::1 @