rec: Prep for 20260806 releases

Signed-off-by: Otto Moerbeek <otto.moerbeek@open-xchange.com>

diff --git a/docs/secpoll.zone b/docs/secpoll.zone
index de755ee1c0234b84ff3c561d2709a2bd5d5a5127..f39eb67ba57619f0e0e565071c2c72827c092886 100644 (file)
--- a/docs/secpoll.zone
+++ b/docs/secpoll.zone
@@ -1,4 +1,4 @@
-@       86400   IN  SOA pdns-public-ns1.powerdns.com. peter\.van\.dijk.powerdns.com. 2026080605 10800 3600 604800 10800
+@       86400   IN  SOA pdns-public-ns1.powerdns.com. peter\.van\.dijk.powerdns.com. 2026080602 10800 3600 604800 10800
 @       3600    IN  NS  pdns-public-ns1.powerdns.com.
 @       3600    IN  NS  pdns-public-ns2.powerdns.com.
 
@@ -455,7 +455,8 @@ recursor-5.2.8.security-status                          60 IN TXT "3 Upgrade now
 recursor-5.2.9.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html"
 recursor-5.2.10.security-status                         60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html"
 recursor-5.2.11.security-status                         60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html"
-recursor-5.2.12.security-status                         60 IN TXT "1 OK"
+recursor-5.2.12.security-status                         60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html"
+recursor-5.2.13.security-status                         60 IN TXT "1 OK"
 
 recursor-5.3.0-alpha1.security-status                   60 IN TXT "3 Superseded pre-release (known vulnerabilities)"
 recursor-5.3.0-alpha2.security-status                   60 IN TXT "3 Superseded pre-release (known vulnerabilities)"
@@ -470,7 +471,8 @@ recursor-5.3.5.security-status                          60 IN TXT "3 Upgrade now
 recursor-5.3.6.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html"
 recursor-5.3.7.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html"
 recursor-5.3.8.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html"
-recursor-5.3.9.security-status                          60 IN TXT "1 OK"
+recursor-5.3.9.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html"
+recursor-5.3.10.security-status                         60 IN TXT "1 OK"
 
 recursor-5.4.0-alpha1.security-status                   60 IN TXT "3 Superseded pre-release (known vulnerabilities)"
 recursor-5.4.0-beta1.security-status                    60 IN TXT "3 Superseded pre-release (known vulnerabilities)"
@@ -479,7 +481,8 @@ recursor-5.4.0.security-status                          60 IN TXT "3 Upgrade now
 recursor-5.4.1.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html"
 recursor-5.4.2.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-08.html"
 recursor-5.4.3.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-10.html"
-recursor-5.4.4.security-status                          60 IN TXT "1 OK"
+recursor-5.4.4.security-status                          60 IN TXT "3 Upgrade now, see https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html"
+recursor-5.4.5.security-status                          60 IN TXT "1 OK"
 
 ; Recursor Debian
 recursor-3.6.2-2.debian.security-status                 60 IN TXT "3 Upgrade now, see https://docs.powerdns.com/recursor/appendices/EOL.html"

diff --git a/pdns/recursordist/docs/changelog/5.2.rst b/pdns/recursordist/docs/changelog/5.2.rst
index 83f2da8c5e5c4c5555ce2a01b1c541f70d691833..96e4362795cc03ea5aaf2d88459d6096a928f3b6 100644 (file)
--- a/pdns/recursordist/docs/changelog/5.2.rst
+++ b/pdns/recursordist/docs/changelog/5.2.rst
@@ -3,6 +3,31 @@ Changelogs for 5.2.X
 
 Before upgrading, it is advised to read the :doc:`../upgrade`.
 
+.. changelog::
+  :version: 5.2.13
+  :released: 6th of August 2026
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17849
+    :tickets: 17797, 17790
+
+    Account for the existing content when parsing labels.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17852
+    :tickets: 17835
+
+    Do not index past the address for byte-aligned prefixes.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17845
+    :tickets: 17772, 17786
+
+    Fix disabling algo 8 also disables DS digest 2.
+
 .. changelog::
   :version: 5.2.12
   :released: 22nd of July 2026

diff --git a/pdns/recursordist/docs/changelog/5.3.rst b/pdns/recursordist/docs/changelog/5.3.rst
index 054578cc0a544605480b281cbe33212105337652..5c17134ef5e0a60305b7d1d3ffe4d3e147ecbb1a 100644 (file)
--- a/pdns/recursordist/docs/changelog/5.3.rst
+++ b/pdns/recursordist/docs/changelog/5.3.rst
@@ -3,6 +3,31 @@ Changelogs for 5.3.X
 
 Before upgrading, it is advised to read the :doc:`../upgrade`.
 
+.. changelog::
+  :version: 5.3.10
+  :released: 6th of August 2026
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17851
+    :tickets: 17835
+
+    Do not index past the address for byte-aligned prefixes.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17848
+    :tickets: 17797, 17790
+
+    Account for the existing content when parsing labels.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17843
+    :tickets: 17772, 17786
+
+    Fix disabling algo 8 also disables DS digest 2.
+
 .. changelog::
   :version: 5.3.9
   :released: 22nd of July 2026

diff --git a/pdns/recursordist/docs/changelog/5.4.rst b/pdns/recursordist/docs/changelog/5.4.rst
index 5132f5b728de1d93446615c345ebe55c54825931..e87c8a7cc3f757affbdd4f04e3fb159b9aef5859 100644 (file)
--- a/pdns/recursordist/docs/changelog/5.4.rst
+++ b/pdns/recursordist/docs/changelog/5.4.rst
@@ -3,6 +3,52 @@ Changelogs for 5.4.X
 
 Before upgrading, it is advised to read the :doc:`../upgrade`.
 
+.. changelog::
+  :version: 5.4.5
+  :released: 6th of August 2026
+
+  .. change::
+    :tags: Improvements
+    :pullreq: 17836
+    :tickets: 16986
+
+    Add ubuntu-resolute build target.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17840
+    :tickets: 17786
+
+    Fix disabling algo 8 also disables DS digest 2.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17847
+    :tickets: 17797, 17790
+
+    Account for the existing content when parsing labels.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17850
+    :tickets: 17835
+
+    Do not index past the address for byte-aligned prefixes.
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17853
+    :tickets: 17157
+
+    Fix DNAME interaction with aggressive use of NSEC3
+
+  .. change::
+    :tags: Bug Fixes
+    :pullreq: 17854
+    :tickets: 17156
+
+    Fix DNSSEC validation of wildcard-expanded proof.
+
 .. changelog::
   :version: 5.4.4
   :released: 22nd of July 2026

diff --git a/pdns/recursordist/docs/security-advisories/powerdns-advisory-2026-11.rst b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2026-11.rst
new file mode 100644 (file)
index 0000000..e09aa8b
--- /dev/null
+++ b/pdns/recursordist/docs/security-advisories/powerdns-advisory-2026-11.rst
@@ -0,0 +1,25 @@
+PowerDNS Security Advisory 2026-11 for PowerDNS Authoritative Server, Recursor and dnsdist: A crafted DNS packet can cause increased memory and CPU consumption
+===============================================================================================================================================================
+
+- CVE: CVE-2026-52682
+- Date: 2026-08-06T00:00:00+01:00
+- Discovery date: 2026-07-28T00:00:00+01:00
+- Affects: PowerDNS Authoritative Server 4.9.16, 5.0.6, 5.1.3, Recursor 5.2.12, 5.3.9, 5.4.4, and dnsdist 1.9.15, 2.0.7, 2.1.0
+- Not affected: PowerDNS Authoritative Server 4.9.17, 5.0.7, 5.1.4, Recursor 5.2.13, 5.3.10, 5.4.5, and dnsdist 1.9.16, 2.0.8, 2.1.1
+- Severity: High
+- Impact: Increased memory and CPU usage
+- Exploit: A crafted DNS packet can cause increased memory and CPU consumption
+- Risk of system compromise: None
+- Solution: Upgrade to patched version
+- CWE: CWE-400
+- CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+- Last affected: auth 5.1.3, 5.0.6, 4.9.16, recursor 5.2.12, 5.3.9, 5.4.4 dnsdist 1.9.15, 2.0.7, 2.1.0
+- First fixed: auth 5.1.4, 5.0.7, 4.9.17, recursor 5.2.13, 5.3.10, 5.4.5, dnsdist 1.9.16, 2.0.8, 2.1.1
+- Internal ID: 17796
+
+A malicious server can send a crafted DNS packet that leads to increased memory and CPU use.
+
+`CVSS Score: 7.5 <https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1>`__
+
+The remedy is: upgrade to a patched version.
+