[ubuntu/resolute-proposed] bind9 1:9.20.24-1ubuntu0.1 (Accepted)
Lena Voytek
lena.voytek at canonical.com
Fri Jul 24 18:15:39 UTC 2026
bind9 (1:9.20.24-1ubuntu0.1) resolute; urgency=medium
* New upstream release 9.20.24 (LP: #2126464)
- Updates:
+ Remove the ineffective TCP fallback after repeated UDP timeouts.
+ Fall back to TCP on receipt of a UDP response with mismatched query ID.
+ Limit glue records cached from a referral per nameserver.
+ Reject a CNAME response to a DS query promptly.
+ Spread cache cleanup probabilistically to avoid CPU spikes and slow
queries when the cache approaches its memory limit.
+ Record query time for all dnstap responses.
+ Optimize TCP source port selection on Linux via IP_LOCAL_PORT_RANGE.
+ Use the zone file's basename as origin in dnssec-signzone and
dnssec-verify.
+ Implement seamless outgoing TCP connection reuse with pipelined queries
per connection capped at 256.
+ Randomize nameserver selection.
+ Make catalog zone names and member zones' entry names case-insensitive.
- Bug fixes:
+ Remove other RRsets at the same name when caching a CNAME.
+ Fix nxdomain-redirect combined with dns64.
+ Fix DNS64 owner-name case after a DNAME restart.
+ Clear the REDIRECT flag when it isn't needed.
+ Disable output escaping in bind9.xsl.
+ Fix crash on badly configured secondary signer missing the file entry.
+ Fix possible crash on concurrent TKEY DELETE for the same key.
+ Reject RRSIG records covering meta-types ANY, AXFR, IXFR, MAILA, MAILB.
+ Fix possible race condition during zone transfers.
+ Fix named crash when processing SIG records in dynamic updates.
+ Fix zone verification of NSEC3 signed zones.
+ Prevent a crash when using both dns64 and filter-aaaa.
+ Fix assertion failure when processing catalog zones with invalid TSIG
key name.
+ Prevent malicious DNSSEC zones from exhausting validator CPU by
rejecting DNSKEYs with oversized RSA public exponent.
+ Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.
+ Prevent crafted queries from degrading RRL performance via
per-process keyed hash.
+ Prevent rare named crash when notifies are cancelled.
+ Stop delv from aborting on malformed query name.
+ Fix crash when reconfiguring while an NTA is being rechecked.
+ Fix bug in allow-query/allow-transfer catalog zone custom properties.
+ Fix memory leak in catalog zones.
+ Fix suppressed missing-glue check in named-checkzone.
+ Reject record sets too large to serve in DNS at storage time.
+ Fix intermittent named crashes during asynchronous zone operations by
enforcing loop affinity.
+ Count temporal DNSSEC validation problems as validation attempts.
+ Fix possible deadlock in RPZ processing.
+ Fix crash triggered by rndc modzone on a zone from a configuration
file.
+ Fix processing of empty catalog zone ACLs.
+ Fix crash triggered by rndc modzone on a zone that already existed in
NZF file.
+ Fix potential resource leak during resolver error handling.
+ Fix handling of key statements defined inside views.
+ Fix use-after-free in dns_client_resolve() triggered by a DNAME
response.
+ Fix assertion failure triggered by non-minimal IXFRs.
+ Fix crash when retrying a NOTIFY over TCP.
+ Improve fetch loop detection for an in-domain nameserver with expired
glue.
+ Fix dnstap logging of forwarded queries.
+ Fix stale answer being served on multiple upstream failures when
following CNAME chains.
+ Fail DNSKEY validation when supported but invalid DS is found..
+ Fix stack memory corruption when importing invalid SKR file.
+ Return FORMERR for queries with EDNS Client Subnet FAMILY field set to
0.
+ Fix inbound IXFR performance regression where very large IXFR
transfers were much slower than in 9.18.
+ Fix implementation of BRID and HHIT record types.
+ Fix implementation of DSYNC record type.
+ Fix response policy and catalog zones to work with INCLUDE directive.
- Remove CVE patches fixed upstream
+ CVE-2026-1519-*.patch
+ CVE-2026-3104-*.patch
+ CVE-2026-3119-*.patch
+ CVE-2026-3591-*.patch
[Fixed in 9.20.21]
+ CVE-2026-3039-*.patch
+ CVE-2026-3592-*.patch
+ CVE-2026-3593-*.patch
+ CVE-2026-5946-*.patch
+ CVE-2026-5947.patch
+ CVE-2026-5950-*.patch
[Fixed in 9.20.23]
Date: Mon, 13 Jul 2026 14:38:03 -0400
Changed-By: Lena Voytek <lena.voytek at canonical.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/+source/bind9/1:9.20.24-1ubuntu0.1
-------------- next part --------------
Format: 1.8
Date: Mon, 13 Jul 2026 14:38:03 -0400
Source: bind9
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 1:9.20.24-1ubuntu0.1
Distribution: resolute
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Lena Voytek <lena.voytek at canonical.com>
Launchpad-Bugs-Fixed: 2126464
Changes:
bind9 (1:9.20.24-1ubuntu0.1) resolute; urgency=medium
.
* New upstream release 9.20.24 (LP: #2126464)
- Updates:
+ Remove the ineffective TCP fallback after repeated UDP timeouts.
+ Fall back to TCP on receipt of a UDP response with mismatched query ID.
+ Limit glue records cached from a referral per nameserver.
+ Reject a CNAME response to a DS query promptly.
+ Spread cache cleanup probabilistically to avoid CPU spikes and slow
queries when the cache approaches its memory limit.
+ Record query time for all dnstap responses.
+ Optimize TCP source port selection on Linux via IP_LOCAL_PORT_RANGE.
+ Use the zone file's basename as origin in dnssec-signzone and
dnssec-verify.
+ Implement seamless outgoing TCP connection reuse with pipelined queries
per connection capped at 256.
+ Randomize nameserver selection.
+ Make catalog zone names and member zones' entry names case-insensitive.
- Bug fixes:
+ Remove other RRsets at the same name when caching a CNAME.
+ Fix nxdomain-redirect combined with dns64.
+ Fix DNS64 owner-name case after a DNAME restart.
+ Clear the REDIRECT flag when it isn't needed.
+ Disable output escaping in bind9.xsl.
+ Fix crash on badly configured secondary signer missing the file entry.
+ Fix possible crash on concurrent TKEY DELETE for the same key.
+ Reject RRSIG records covering meta-types ANY, AXFR, IXFR, MAILA, MAILB.
+ Fix possible race condition during zone transfers.
+ Fix named crash when processing SIG records in dynamic updates.
+ Fix zone verification of NSEC3 signed zones.
+ Prevent a crash when using both dns64 and filter-aaaa.
+ Fix assertion failure when processing catalog zones with invalid TSIG
key name.
+ Prevent malicious DNSSEC zones from exhausting validator CPU by
rejecting DNSKEYs with oversized RSA public exponent.
+ Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.
+ Prevent crafted queries from degrading RRL performance via
per-process keyed hash.
+ Prevent rare named crash when notifies are cancelled.
+ Stop delv from aborting on malformed query name.
+ Fix crash when reconfiguring while an NTA is being rechecked.
+ Fix bug in allow-query/allow-transfer catalog zone custom properties.
+ Fix memory leak in catalog zones.
+ Fix suppressed missing-glue check in named-checkzone.
+ Reject record sets too large to serve in DNS at storage time.
+ Fix intermittent named crashes during asynchronous zone operations by
enforcing loop affinity.
+ Count temporal DNSSEC validation problems as validation attempts.
+ Fix possible deadlock in RPZ processing.
+ Fix crash triggered by rndc modzone on a zone from a configuration
file.
+ Fix processing of empty catalog zone ACLs.
+ Fix crash triggered by rndc modzone on a zone that already existed in
NZF file.
+ Fix potential resource leak during resolver error handling.
+ Fix handling of key statements defined inside views.
+ Fix use-after-free in dns_client_resolve() triggered by a DNAME
response.
+ Fix assertion failure triggered by non-minimal IXFRs.
+ Fix crash when retrying a NOTIFY over TCP.
+ Improve fetch loop detection for an in-domain nameserver with expired
glue.
+ Fix dnstap logging of forwarded queries.
+ Fix stale answer being served on multiple upstream failures when
following CNAME chains.
+ Fail DNSKEY validation when supported but invalid DS is found..
+ Fix stack memory corruption when importing invalid SKR file.
+ Return FORMERR for queries with EDNS Client Subnet FAMILY field set to
0.
+ Fix inbound IXFR performance regression where very large IXFR
transfers were much slower than in 9.18.
+ Fix implementation of BRID and HHIT record types.
+ Fix implementation of DSYNC record type.
+ Fix response policy and catalog zones to work with INCLUDE directive.
- Remove CVE patches fixed upstream
+ CVE-2026-1519-*.patch
+ CVE-2026-3104-*.patch
+ CVE-2026-3119-*.patch
+ CVE-2026-3591-*.patch
[Fixed in 9.20.21]
+ CVE-2026-3039-*.patch
+ CVE-2026-3592-*.patch
+ CVE-2026-3593-*.patch
+ CVE-2026-5946-*.patch
+ CVE-2026-5947.patch
+ CVE-2026-5950-*.patch
[Fixed in 9.20.23]
Checksums-Sha1:
10c62bd6ef8de06c4f37667db3e5ffb5dc028f1f 3133 bind9_9.20.24-1ubuntu0.1.dsc
21a0a1592548dbae73e5cf6077f9cf0bf9d48620 5854912 bind9_9.20.24.orig.tar.xz
4d96a107067def812b1931897bb0578cd4a971f4 833 bind9_9.20.24.orig.tar.xz.asc
84cca8c761d9c9fc939a213265fe663511dfdb43 76168 bind9_9.20.24-1ubuntu0.1.debian.tar.xz
1a0203f22c07959e4aa37a770e7c33eb45a2ab52 8976 bind9_9.20.24-1ubuntu0.1_source.buildinfo
Checksums-Sha256:
dcf3ee6bd12880d0278871a7bf5f0d8070dd04f6456f5af1b12ab6b5d4b479cb 3133 bind9_9.20.24-1ubuntu0.1.dsc
989fef1fc88ea59d04cd86f854dca5a4616a20a9968bcdde3c1a3668ab36be08 5854912 bind9_9.20.24.orig.tar.xz
c35569419a3bb74656854a448661064281d1ede5ee3daa5e14de3a66cf53d2d3 833 bind9_9.20.24.orig.tar.xz.asc
356ddfa78c3b9d7b73577e0d37c441e4da6bc79b62cde5de17c0267d6ca5d13f 76168 bind9_9.20.24-1ubuntu0.1.debian.tar.xz
b9d65ca84179acf77927669b256df6fc2e6c99735d1ef4d14d4e6f02da8e2c27 8976 bind9_9.20.24-1ubuntu0.1_source.buildinfo
Files:
7079dcc77bc3d2b8d60eaafae8f9d92d 3133 net optional bind9_9.20.24-1ubuntu0.1.dsc
ba08036610502ea8abe849edd3655cdb 5854912 net optional bind9_9.20.24.orig.tar.xz
409884a1691ea4f9f9252d87ad65a7c8 833 net optional bind9_9.20.24.orig.tar.xz.asc
ba89ffeda4ee261031090001670a7ef9 76168 net optional bind9_9.20.24-1ubuntu0.1.debian.tar.xz
ceb38466367f8df1013040f56c485133 8976 net optional bind9_9.20.24-1ubuntu0.1_source.buildinfo
Original-Maintainer: Debian DNS Team <team+dns at tracker.debian.org>
Vcs-Git: https://git.launchpad.net/~lvoytek/ubuntu/+source/bind9
Vcs-Git-Commit: eaca9abab6014ee68bf13e82e80bc73fcc610ec5
Vcs-Git-Ref: refs/heads/backport-9.20.24-resolute
More information about the Resolute-changes
mailing list