-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 21 Jul 2026 15:09:54 +0200
Source: bind9
Binary: bind9-doc
Architecture: all
Version: 1:9.20.26-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Description:
 bind9-doc  - Documentation for BIND 9
Changes:
 bind9 (1:9.20.26-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.26
    + [CVE-2026-10723]: Correct verification of NSEC3 signer name.
    + [CVE-2026-10822]: Malformed DNSKEY records could trigger an
      assertion.
    + [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns
      too-long name.
    + [CVE-2026-11605]: Prevent excessive validation work from crafted
      negative responses.
    + [CVE-2026-11622]: Prevent cache exhaustion under sustained attack.
    + [CVE-2026-11721]: Stop accepting invalid signed wildcard records.
    + [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME
      queries.
    + [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response.
    + [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC
      Next Field.
Checksums-Sha1:
 73b9fd23ffc8e19ffb4cd149d5a73fe9fc129c37 3632392 bind9-doc_9.20.26-1~deb13u1_all.deb
 b5e20783ac949ef20aad96364ba06652006f1b61 11393 bind9_9.20.26-1~deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 b6003c99255c580914d9c05e905f45d6b800cc80767132180610c0215a4aa44d 3632392 bind9-doc_9.20.26-1~deb13u1_all.deb
 0ea3c03125ab4f730f6a17a297d18f58cdc55d062b9d37917f774fb9155a21f8 11393 bind9_9.20.26-1~deb13u1_all-buildd.buildinfo
Files:
 1e1127258a846e276d2317b9ca6e8706 3632392 doc optional bind9-doc_9.20.26-1~deb13u1_all.deb
 d3355cf9597969a9e51230b74e3aa27a 11393 net optional bind9_9.20.26-1~deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmpfd1cACgkQmgPNRvTf
/zeq8A/9GPP/TwNjrTdidj9VuR1wFAczSw9CXqTw8JANac/5guhaPpihwfatO3Wx
Svo3tDZQgNiB1q81BQzfowlB8Ej6TguJwHSVVPVl2DmmtZaFEc+hWBwCK2TROufe
HN1IXAveT92LOo0RdcwaARJ1/3GUfV5wOEmefB3EVbajLrQjYqwBJ1gHtNpnPyY0
D0DWtMnTh++gwf3jxgkrr0qbIhIvbvKVzn03FV4riMH1BTwNtigjhyaqRjohDH7L
teyVz1wBw2KfTTG348J1FvnzBr5bUNRcbGj7MgMgtYSjbfwz6n05mqIHNGandBZB
p2/iFH1jurIYtGXB/D96Z4XscAGTKO03zpmtYdxhRcWmVUfkzZZp8k4CBmG/tMcF
dOp2lyKIKvHRyLU0sdGTJM9FdWhZowMioD3WBE92vwyuOb/K2NuE0YbIjZrA4Hwo
utHI5WrVa9G5iqQ4XLdmkUUEUKui+RjDg7/w5T01fiskROU8QoLvHADV/tOAtSPw
B6nT48EbuZqUQHYjvOnR97Ru+jLhwee7kr+BEyGb2LtsU9lmnkiHSGAJ1aiQg3MP
ObVkYqStWCllBg3VEL+mZcyFGLApfVo0oTuZxSis4VWmYy+YF04NcSEDykAi/0i/
FaGg60+uvwKNEW4gYakQ45hIgyz6KhEXJ6DMR4et2O2tcQbPFrQ=
=Ugv8
-----END PGP SIGNATURE-----