Skip to content

bind: bump to 9.20.26#30084

Open
nmeyerhans wants to merge 1 commit into
openwrt:masterfrom
nmeyerhans:master
Open

bind: bump to 9.20.26#30084
nmeyerhans wants to merge 1 commit into
openwrt:masterfrom
nmeyerhans:master

Conversation

@nmeyerhans

Copy link
Copy Markdown
Contributor

Fixes several security issues:

  • CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long.
  • CVE-2026-11721 Invalid signed wildcard records were being accepted.
  • CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
  • CVE-2026-10723 Correct verification of NSEC3 signer name.
  • CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries.
  • CVE-2026-10822 Malformed DNSKEY records could trigger an assertion.
  • CVE-2026-11605 Prevent excessive validation work from crafted negative responses.
  • CVE-2026-11622 Prevent cache exhaustion under sustained attack.

Full release notes are available upstream at
https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html

📦 Package Details

Maintainer: me

🧪 Run Testing Details

  • OpenWrt Version: master
  • OpenWrt Target/Subtarget: mvebu/cortexa9
  • OpenWrt Device: wrt1900acs

✅ Formalities

  • I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

  • It can be applied using git am
  • It has been refreshed to avoid offsets, fuzzes, etc., using
    make package/<your-package>/refresh V=s
  • It is structured in a way that it is potentially upstreamable
    (e.g., subject line, commit description, etc.)
    We must try to upstream patches to reduce maintenance burden.

Fixes several security issues:
 - CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long.
 - CVE-2026-11721 Invalid signed wildcard records were being accepted.
 - CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
 - CVE-2026-10723 Correct verification of NSEC3 signer name.
 - CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries.
 - CVE-2026-10822 Malformed DNSKEY records could trigger an assertion.
 - CVE-2026-11605 Prevent excessive validation work from crafted negative responses.
 - CVE-2026-11622 Prevent cache exhaustion under sustained attack.

Full release notes are available upstream at
https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html

Signed-off-by: Noah Meyerhans <frodo@morgul.net>
@nmeyerhans

Copy link
Copy Markdown
Contributor Author

[allow branch]

1 similar comment
@BKPepe

BKPepe commented Jul 23, 2026

Copy link
Copy Markdown
Member

[allow branch]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants