Debian Patches

Status for bind9/1:9.18.49-1~deb12u2

Patch Description Author Forwarded Bugs Origin Last update
0010-Fix-dns_name_fromwire-to-honour-the-active-region.patch Fix dns_name_fromwire to honour the active region
dns_name_fromwire was not honouring the source buffer's active
region when reading names from the wire. This allowed malformed
records to be accepted when they shouldn't have been. This has
been corrected.

(cherry picked from commit 7c4f07a7ef6b571073327b02209df7f75b9363ff)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/e73b70a64453e7d97a11cb5f0afe8bb02d34aaf8 2026-05-19
0011-Check-that-a-short-PRIVATEDNS-record-is-rejected.patch Check that a short PRIVATEDNS record is rejected
A bug in dns_name_fromwire meant that short PRIVATEDNS key
records where being accepted. Test that this is no longer
the case.

(cherry picked from commit f48d48027384d8c2210b5ce9e3eac7af101ead3d)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/19ac8b8e46aeb0a15e217bc7bdf485b31b87d9b4 2026-05-19
0012-POC-for-PRIVATEDNS-DNSKEY-overrun-not-being-detected.patch POC for PRIVATEDNS DNSKEY overrun not being detected
Construct a DNS message where a PRIVATEDNS DNSKEY identifier
overruns the record boundary by 3 byte so that the label ends
at the end of the compression pointer for the next record. The
next type is less than 256 so the next octet is 00 terminating
the identifier name. The transfered zone is then written to
disk using master-format text triggering the assertion when the
truncated identier is discovered.

Note this test will produce a false result in versions of
BIND that do not check the PRIVATEDNS identifier as it looks
for the error message when the transfer is aborted.

(cherry picked from commit 9ce3bce8bc8b4e9c6a9b1e84b5849c33eb27830e)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/8e066d3fc369e3346f22bb5cfb67a7ab08a74034 2026-06-05
0013-Fix-TTL-extraction-from-A-AAAA-record.patch Fix TTL extraction from A/AAAA record
(cherry picked from commit 89c86e338db2492b92e6618c586f146c6928dc6d)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/adc8285d23e2eac6ec463f5dbc5a9596fdd36c60 2026-04-10
0014-Check-rpz-name-too-long-wildcard-CNAME-expansion-han.patch Check rpz name too long wildcard CNAME expansion handling
(cherry picked from commit 9345394e2097031b55b3ef34ceaadf5a7ebbeef2)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/095b11f20f911f5b8059bdc349b256d6c64ece30 2026-04-10
0015-Properly-handle-rpz-name-to-long-wildcard-expansion.patch Properly handle rpz name to long wildcard expansion
Previously a self referential CNAME and the original address
record were returned. We now return a YXDOMAIN response.

(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/dc328a199f96222e0c30cc20b7b795bfc2c9b2e4 2026-04-10
0016-Make-the-dns_slabheaders-in-the-cache-reference-coun.patch Make the dns_slabheaders in the cache reference counted
Instead of only reference counting the enclosing qpcnode, add the
reference counting directly to the slabheaders. The reference is
incremented when an rdataset is bound to the header and decremented when
the rdataset is disassociated, so a stale slabheader can be removed from
the node's down chain as soon as its own reference count reaches zero,
instead of waiting for the whole qpcnode to become unreferenced.

Building on that, clean up the ancient headers eagerly: mark_ancient()
is made idempotent, releases the header's own (container) reference and
reaps the stale headers from the node's down chain as soon as their
references reach zero. A header evicted over the per-name type limit is
expired only after the new rdataset has been bound, so the bind's
increment always precedes mark_ancient()'s decrement.

Because a header can now be reclaimed independently of its node, the
rdataset iterators must keep the header they are positioned on alive:
each iterator takes a reference on its current header and releases it
when it advances or is destroyed. Iteration otherwise stays lazy and
re-reads the node on every step, so it still observes records added to
the node while the iterator is live, as zone signing requires.

The slab headers are shared with the zone databases, so the matching
increment is added to every bind path. The noqname/closest proofs hand
out rdatasets backed by bare slabs that have no header, so they are
given a separate dns_rdataproof_rdatasetmethods that leaves the
reference count untouched.

(cherry picked from commit 2dabf117e1264fd13fb33096f87e78a039fd1c6c)		 Ondřej Surý <ondrej@sury.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/231b1ca3edfb26389e1af39181aa6b4413e87ec4 2026-06-23
0001-Disable-treat-warnings-as-errors-in-sphinx-build.patch Disable treat-warnings-as-errors in sphinx-build Ondřej Surý <ondrej@debian.org> no 2022-05-18
0002-Add-support-for-reporting-status-via-sd_notify.patch Add-support-for-reporting-status-via-sd_notify Debian DNS Team <team+dns@tracker.debian.org> no 2023-01-25
0003-Disable-RTLD_DEEPBIND-in-Samba-DLZ-module.patch Disable RTLD_DEEPBIND in Samba DLZ module
When RTLD_DEEPBIND is enabled in the LDB modules inside the Samba DLZ
plugin, and jemalloc is the BIND 9 memory allocator, there's a mismatch
in the used symbols and the LDB allocates memory using BIND 9
allocator (jemalloc), but frees the memory using RLTD_DEEPBIND free()
symbol from libc. This causes assertion failure on BIND 9 startup.		 Ondřej Surý <ondrej@isc.org> no 2024-07-27
0004-add-isctest.mark-method-for-ecdsa_deterinistic.patch add isctest.mark method for ecdsa_deterinistic
This checks support for ECDSA deterministic mode in the cryptography
library.

(cherry picked from commit 6e44151466864d3dd783a20da83d01028781d3e2)		 Evan Hunt <each@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/dc3f52388427f4f94087d984d5a2088b925810e2 2026-07-01
0005-Check-NSEC3-signer-matches-the-owning-zone.patch Check NSEC3 signer matches the owning zone
When validating NSEC3 records, reject any signature whose signer field
does not match the zone owning the NSEC3.

This ensures that a child zone cannot impersonate its parent and forge
NXDOMAIN responses for sibling domains.

(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)		 Evan Hunt <each@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb 2026-05-21
0006-Reproducer-for-5874-NSEC3-impersonation.patch Reproducer for #5874 NSEC3 impersonation
LLM generated.

(cherry picked from commit f3e2eb333be3ac636f745aa13cfb8d9ee8af87d8)		 Alessio Podda <alessio@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/35e3d49d2222c13786a06021c7ed583d2a656e51 2026-06-03
0007-Update-reproducer-5874.patch Update reproducer #5874
Update the llm generated reproducer:
- Move server.py into ans1/ans.py
- Remove unnecessary named.conf configuration options
- Add comments describing the steps (copied from GL issue)
- Rename system test

(cherry picked from commit c1321fef165a2ef8c2bff971901c58941e8e694c)		 Matthijs Mekking <matthijs@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/833dd3b230b92596074e8da15b12298f46c939f2 2026-06-04
0008-Check-that-dns_name_fromwire-honours-the-active-regi.patch Check that dns_name_fromwire honours the active region
When reading DNS records from the wire the active region of the
source buffer is set to the end of the current record. dns_name_fromwire
should fail if it attempts to read past this setting.

(cherry picked from commit 3ed821d68b15fe4e6288e3054397d6bce7e65968)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/d413c9ac2e29a728531354a69c8c8234c01b7d1e 2026-05-19
0009-Fix-the-yaml-query-zone-name-code-in-dnstap-read.patch Fix the yaml query zone name code in dnstap-read
When the buffer to read the query zone name was constructed
isc_buffer_setactive was not called. This is now needed as
dns_name_fromwire is being corrected to check the active region.

(cherry picked from commit a25522c28c46655a81d2bf1d96374c81d834b157)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/a5f1a9d0d2ec021618924b14202ac96ead8299c1 2026-05-19
0017-Don-t-sign-out-of-zone-records-in-dnssec-signzone.patch Don't sign out of zone records in dnssec-signzone
dnssec-signzone was signing extraneous records that were not within
the namespace of the zone. This no longer occurs.

(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)

Don't sign out of zone records in dnssec-signzone

dnssec-signzone was signing extraneous records that were not within
the namespace of the zone. This no longer occurs.

(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/1a4986e2533f87e80eb21da3f06708d335aff1e2 2026-04-14
0018-Invalid-signed-wildcard-records-were-being-accepted.patch Invalid signed wildcard records were being accepted
An RRSIG whose Labels field indicates fewer labels than its signer
name requires was being accepted. When such a record covers a
wildcard, the validator reconstructs a wildcard owner name above the
signer's zone and caches it as secure. RFC 8198 cache synthesis
(synth-from-dnssec) then serves that forged wildcard for unrelated
names, poisoning the cache.

These records are now rejected, both when an RRSIG is parsed and when
its signature is verified.

(cherry picked from commit 084ca5ee10515e461d46b63df9660b8394bc7de9)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/15089066b15f826d7487c3d160b5872820f84b83 2026-04-14
0019-Test-RRSIG-record-parsing.patch Test RRSIG record parsing
In particular test that labels and signer fields are consistent.

(cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2)		 Mark Andrews <marka@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/19e496ca260b6a756ae1378e8ebcbdb666b7d9ed 2026-04-14
0020-Do-not-assert-in-some-CNAME-DNAME-queries.patch Do not assert in some CNAME/DNAME queries
Fix a `named` crash because of a fail assertion for certains types of
CNAME and DNAME queries:

- If a client queries for a DNAME and A record to the resolver, and the
authoritative server responds positively to the A query but delay the
DNAME response and respond later negatively;

- If a client queries for a CNAME and A record to the resolver, and the
authoritative server responds positively to the A query but delay the
CNAME response and respond later with a self-referential CNAME.

The first scenario consists of sending two queries: `foo.test./DNAME`
and `a.foo.test./A`. The authoritative server delays the answer for
`foo.test./DNAME` but immediately answers the DNAME record for the
second query: `foo.test. DNAME bar.test.`. The resolver caches it,
follows the DNAME, and resolves `a.bar.test./A`. The authoritative
server eventually answers negatively for `foo.test./DNAME`
(NOERROR/NODATA, with only an SOA in the authority section). The
resolver pulls out the previously cached rdataset (because it has a
higher trust level than the received negative answer), and wrongly (this
is the first bug) sets the result to `DNS_R_DNAME` instead of
`ISC_R_SUCCESS`. The code in `ns/query.c` that handles the resolver
result interprets this as "this is a non-DNAME query and we got a DNAME
rdataset, so follow the chain". It goes into the `query_dname()`
function, which asserts that the qname is a subdomain of the owner name
in the rdataset. That assertion fails because the qname (`foo.test.`) is
exactly equal to the owner name of the DNAME (`foo.test.`), rather than
being a subdomain of it. `DNS_R_DNAME` must only be set when the qtype
is something other than DNAME and the resolver has obtained a DNAME that
needs to be followed.

The second scenario consists of sending two queries:
`cname.foo.test./CNAME` and `cname.foo.test./A`. The authoritative
server delays the answer for `cname.foo.test./CNAME` but immediately
answers the CNAME record for the second query: `cname.foo.test. CNAME
cname.foo.test.`. Note that the CNAME is self-referential. The resolver
caches it and sets the result code to `DNS_R_CNAME`. Then `ns/query.c`
interprets this as "this is a non-CNAME query and we got a CNAME
rdataset, so follow the chain" (which is correct in this case; however,
because the CNAME rdataset is self-referential, the resolver responds
with SERVFAIL, which is expected). The authoritative server eventually
answers negatively for `cname.foo.test./CNAME`. The resolver then pulls
out the previously cached CNAME rdataset (obtained from the A answer,
even though it was self-referential, the resolver cached it) and wrongly
sets the result to `DNS_R_CNAME` (this is the second bug). As noted
above, `ns/query.c` interprets this as "this is a non-CNAME query and we
got a CNAME rdataset, so follow the chain". The internals here are
slightly more subtle: it first goes into `query_cname()` and sets the
CNAME rdataset in the message answer section, then restarts the query to
follow the CNAME. The restart retrieves the CNAME rdataset from the
cache directly (without going to the resolver), and this time the query
context result is `ISC_R_SUCCESS` (since it was found) and
`qctx->rdataset` points to the same CNAME again (as it is
self-referential), so it goes directly into the
`query_prepresponse()/query_respond()` flow, which attempts to add the
rdataset to the message answer again. However, this fails because the
rdataset is already in the message, and the assertion which expects that
operation to succeed fails (due to `qctx->rdataset` being set to `NULL`
when ownership of the rdataset was transferred). `DNS_R_CNAME` must only
be set when the qtype is something other than CNAME and the resolver has
obtained a CNAME that needs to be followed.

In both cases, the correct answer from the resolver should have been
`ISC_R_SUCCESS` (instead of respectively `DNS_R_DNAME` and
`DNS_R_CNAME`) becuase the rdataset that has been looked up was found.

(cherry picked from commit 773d46d58c693047a5945c8fe40512edd0ac214e)		 Colin Vidal <colin@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/c740c37689f234e21a9b0ef760471ef2cf1133f5 2026-06-18
0021-Reproducer-for-5946-assertion-in-some-CNAME-DNAME-qu.patch Reproducer for #5946 (assertion in some CNAME/DNAME queries)
Add a system test reproducing the issue reported by #5946, which
is also CVE-2026-12617. There are two scenarios:

- A client send queries for a DNAME and A record to the resolver (ns3),
and the authoritative server (ans2) responds positively to the A query
but delay the DNAME response and respond later negatively;

- A client send queries for a CNAME and A record to the resolver (ns3),
and the authoritative server (ans2) responds positively to the A query
but delay the CNAME response and respond later with a self-referential
CNAME.

The test does not check the results of the queries, however, it expects
the resolver to correctly handle those and do not assert.

(cherry picked from commit e88271f2e584010157b068cc998dd76451273562)		 Colin Vidal <colin@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/bb92832fb6ae899bee7206c2d8966258461c2f71 2026-06-15
0022-Reproducer-for-5985-addnoqname-mismatch.patch Reproducer for #5985 addnoqname mismatch
LLM generated.

(cherry picked from commit 5f4de929b3e4749b6e32c51660be11c47c2514e6)		 Alessio Podda <alessio@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/0cf010c153518f1f9831e201891ecba8d8ba65e1 2026-06-12
0023-Update-reproducer-5985.patch Update reproducer #5985
Update the llm generated reproducer:
- Move server.py into ans/ans1.py
- Remove unncessary named.conf configuration options
- Add comments describing the steps
- Rename system test

(cherry picked from commit fd539807829dd7d2eb76c8b503083f5d84fec6f0)		 Matthijs Mekking <matthijs@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/6c0e599ea85c0c53a4af09742e64e193da089bb4 2026-06-15
0024-dns_rdataset_addnoqname-could-find-unsigned-NSEC-NSE.patch dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3
The dns_rdatalist addnoqname() implementation searches for the first
NSEC or NSEC3 record in a message, then for the first RRSIG covering
that type in the same message. Previously, if no RRSIG for the type was
found, the function accepted the unsigned record. Now, it will instead
continue searching until an NSEC or NSEC3 that does have a matching
signature is found.

When this function is called from validated() in resolver.c, a
non-success return code is now treated as an error instead of triggering
an assertion failure.

(cherry picked from commit 57cba571ee31311e54d8a11cb38094d439f04e09)		 Evan Hunt <each@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/48f5aa5fb3746d6194edcc57e8792a8b3cc3b454 2026-05-13
0025-Add-system-test-for-out-of-zone-nsec-dnssec-bypass.patch Add system test for out-of-zone nsec dnssec bypass
A malicious zone with out-of-zone NSEC entries can get a DNSSEC
validating resolver's cache to cover the victim zone for non-existence
and prevent nameserver queries without DNSSEC failure.

Test for this case with an `evil.test` zone that tries to cover the
`victim.test` zone.

(cherry picked from commit 654f9773c0af59965c343bdfeb096b3dffe9dd53)		 Aydın Mercan <aydin@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/c969ad2c17b43dd999e358bfeb280d3df6fab822 2026-05-06
0026-Reject-out-of-zone-NSEC-next-owner-names.patch Reject out-of-zone NSEC next owner names
When verifying DNSSEC records, make sure that a next owner name of
an NSEC record is a subdomain of the signer field.

This follows the specification RFC 4034, section 4.1.1:

Owner names of RRsets for which the given zone is not authoritative
(such as glue records) MUST NOT be listed in the Next Domain Name
unless at least one authoritative RRset exists at the same owner
name.

While the above paragraph is intended for glue records, it also
applies to out-of-zone data.

(cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9)		 Aydın Mercan <aydin@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/058023c66f11d78590d4aa8c4f98946c4c965e21 2026-05-07
0027-change-dns_nsec_requiredtypespresent-to-dns_nsec_is_.patch change dns_nsec_requiredtypespresent to dns_nsec_is_legal
Change `dns_nsec_requiredtypespresent` to `dns_nsec_is_legal` as a
function for checking multiple NSEC validity rules.

Currently we now additionally check for out-of-zone NSEC entries.

(cherry picked from commit be2a6a497312469890b552907d039d2de0b44ccc)		 Aydın Mercan <aydin@isc.org> no https://gitlab.isc.org/isc-projects/bind9/-/commit/f751e19a30d107f04c2f644aff9f8dab8fed03ab 2026-05-12

All known versions for source package 'bind9'

Links