From: Michał Kępień Date: Mon, 13 Jul 2026 10:40:29 +0000 (+0200) Subject: Reorder release notes X-Git-Tag: v9.21.24~1^2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=d1ce1551294e23c8d27d2ccd7133ee88d8296bb2;p=thirdparty%2Fbind9.git Reorder release notes --- diff --git a/doc/notes/notes-9.21.24.rst b/doc/notes/notes-9.21.24.rst index ae39303237d..526667c60a8 100644 --- a/doc/notes/notes-9.21.24.rst +++ b/doc/notes/notes-9.21.24.rst @@ -15,6 +15,23 @@ Notes for BIND 9.21.24 Security Fixes ~~~~~~~~~~~~~~ +- Correct verification of NSEC3 signer name. :cve:`2026-10723` + + Previously, :iscman:`named` accepted child-zone NSEC3 records where + the first label equaled the hash of the parent zone as valid + parent-zone closest encloser proofs. This has been fixed. + + ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing + this vulnerability to our attention. :gl:`#5874` + +- Malformed DNSKEY records could trigger an assertion. :cve:`2026-10822` + + Previously, ``dns_name_fromwire()`` did not honor the record boundary + when reading names from the wire, allowing malformed records to be + accepted when they should not have been. In particular, malformed + DNSKEY records could trigger an assertion failure when being printed. + This has been fixed. :gl:`#6004` + - Fix handling of RPZ CNAME expansion that returns too-long name. :cve:`2026-11331` @@ -28,6 +45,24 @@ Security Fixes ISC would like to thank Laith Mash'al (0xmshal) for bringing this vulnerability to our attention. :gl:`#5856` +- Prevent excessive validation work from crafted negative responses. + :cve:`2026-11605` + + Previously, a validating resolver could be made to perform a large + amount of DNSSEC validation work in response to a single answer, + consuming excessive CPU. A malicious authoritative server could + trigger this by returning a signed negative answer (NXDOMAIN or + NODATA) padded with many denial-of-existence proof records, which the + resolver continued to verify beyond its per-query validation limit. It + now enforces that limit on negative answers and returns SERVFAIL once + the limit is reached. :gl:`#4463` + +- Prevent cache exhaustion under sustained attack. :cve:`2026-11622` + + Cache memory could become exhausted with expired entries whose memory + was not released, due to a sustained attack on the same DNS name that + prevented the cleanup. This has been fixed. :gl:`#4760` + - Stop accepting invalid signed wildcard records. :cve:`2026-11721` Signed wildcard responses in which the Labels field in the RRSIG @@ -39,6 +74,14 @@ Security Fixes ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention. :gl:`#5871` +- Prevent crash from malformed NSEC/NSEC3 response. :cve:`2026-13204` + + An assertion could be triggered by an improperly signed NOQNAME proof. + This has been fixed. + + ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing + this vulnerability to our attention. :gl:`#5985` + - Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. :cve:`2026-13321` @@ -51,23 +94,6 @@ Security Fixes ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing this vulnerability to our attention. :gl:`#5873` -- Correct verification of NSEC3 signer name. :cve:`2026-10723` - - Previously, :iscman:`named` accepted child-zone NSEC3 records where - the first label equaled the hash of the parent zone as valid - parent-zone closest encloser proofs. This has been fixed. - - ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing - this vulnerability to our attention. :gl:`#5874` - -- Malformed DNSKEY records could trigger an assertion. :cve:`2026-10822` - - Previously, ``dns_name_fromwire()`` did not honor the record boundary - when reading names from the wire, allowing malformed records to be - accepted when they should not have been. In particular, malformed - DNSKEY records could trigger an assertion failure when being printed. - This has been fixed. :gl:`#6004` - - Reclaim memory promptly when DNSSEC validations are canceled. When a resolver is flooded with queries that require DNSSEC validation @@ -79,24 +105,6 @@ Security Fixes work queue is now dropped as soon as the validation is canceled, releasing the memory it was holding. :gl:`#4760` -- Prevent excessive validation work from crafted negative responses. - :cve:`2026-11605` - - Previously, a validating resolver could be made to perform a large - amount of DNSSEC validation work in response to a single answer, - consuming excessive CPU. A malicious authoritative server could - trigger this by returning a signed negative answer (NXDOMAIN or - NODATA) padded with many denial-of-existence proof records, which the - resolver continued to verify beyond its per-query validation limit. It - now enforces that limit on negative answers and returns SERVFAIL once - the limit is reached. :gl:`#4463` - -- Prevent cache exhaustion under sustained attack. :cve:`2026-11622` - - Cache memory could become exhausted with expired entries whose memory - was not released, due to a sustained attack on the same DNS name that - prevented the cleanup. This has been fixed. :gl:`#4760` - Removed Features ~~~~~~~~~~~~~~~~ @@ -243,14 +251,6 @@ Bug Fixes entry expired, even when the CNAME target itself was otherwise resolvable. This has been fixed. :gl:`#5983` -- Prevent crash from malformed NSEC/NSEC3 response. :cve:`2026-13204` - - An assertion could be triggered by an improperly signed NOQNAME proof. - This has been fixed. - - ISC would like to thank Qifan Zhang of Palo Alto Networks for bringing - this vulnerability to our attention. :gl:`#5985` - - Reject unsupported RSA DNSKEY shapes during DNSSEC validation. An authoritative server publishing an RSA DNSKEY with an unusually