-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 21 Jul 2026 15:09:54 +0200
Source: bind9
Binary: bind9 bind9-dbgsym bind9-dev bind9-dnsutils bind9-dnsutils-dbgsym bind9-host bind9-host-dbgsym bind9-libs bind9-libs-dbgsym bind9-utils bind9-utils-dbgsym
Architecture: i386
Version: 1:9.20.26-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) <buildd_amd64-x86-ubc-02@buildd.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Description:
 bind9      - Internet Domain Name Server
 bind9-dev  - Static Libraries and Headers used by BIND 9
 bind9-dnsutils - Clients provided with BIND 9
 bind9-host - DNS Lookup Utility
 bind9-libs - Shared Libraries used by BIND 9
 bind9-utils - Utilities for BIND 9
Changes:
 bind9 (1:9.20.26-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.26
    + [CVE-2026-10723]: Correct verification of NSEC3 signer name.
    + [CVE-2026-10822]: Malformed DNSKEY records could trigger an
      assertion.
    + [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns
      too-long name.
    + [CVE-2026-11605]: Prevent excessive validation work from crafted
      negative responses.
    + [CVE-2026-11622]: Prevent cache exhaustion under sustained attack.
    + [CVE-2026-11721]: Stop accepting invalid signed wildcard records.
    + [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME
      queries.
    + [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response.
    + [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC
      Next Field.
Checksums-Sha1:
 10d22db702efb64652db2c727581e5fede8e41d8 611496 bind9-dbgsym_9.20.26-1~deb13u1_i386.deb
 33e0d4a373836953ba284068bd0430dedb90c42c 296376 bind9-dev_9.20.26-1~deb13u1_i386.deb
 6047aaf02076ae68b151c87faed7a5a88322778b 392492 bind9-dnsutils-dbgsym_9.20.26-1~deb13u1_i386.deb
 8ebb0af913138994fec5ea76d072445ccb4705a4 170628 bind9-dnsutils_9.20.26-1~deb13u1_i386.deb
 0306b6dd51402decc7179f07b2850505dd02e03c 93968 bind9-host-dbgsym_9.20.26-1~deb13u1_i386.deb
 ab1479dafe241e46ffa93d20bc09964d9ae99d5d 58016 bind9-host_9.20.26-1~deb13u1_i386.deb
 8a907699426e6b25e8ea4131f5aa29a446e51616 3540120 bind9-libs-dbgsym_9.20.26-1~deb13u1_i386.deb
 52048d3872463cb778982c646c9582b152b6a7ac 1327932 bind9-libs_9.20.26-1~deb13u1_i386.deb
 0a41bf8898abb364c3e209a6466df890636d766f 449464 bind9-utils-dbgsym_9.20.26-1~deb13u1_i386.deb
 693a39e6a61453522c4cdf1857ad3e5ba87a1755 186284 bind9-utils_9.20.26-1~deb13u1_i386.deb
 cf379d6dc5d0ac89178fefb429b76f0043bfbefa 10460 bind9_9.20.26-1~deb13u1_i386-buildd.buildinfo
 6a69b5debfe667ee441ec09d5ebbe3e980e204d7 270736 bind9_9.20.26-1~deb13u1_i386.deb
Checksums-Sha256:
 c34633a34a1e4559c8545a6c192c4d458b5aa2f0c3721c0e516ecc63babc31c1 611496 bind9-dbgsym_9.20.26-1~deb13u1_i386.deb
 3fb097fb3aea6c1e08af5a5c304ec97dd1735bf3f48eeab243a9d85ee7ed4ac2 296376 bind9-dev_9.20.26-1~deb13u1_i386.deb
 dbd81191345a3c217da04f9a0f05548a11791181876d82d2b29c89b0551f8cbd 392492 bind9-dnsutils-dbgsym_9.20.26-1~deb13u1_i386.deb
 904a3c16c33a1d77bbabe3da261fa8a5fb1b2928a4c739e2c4487d579874e469 170628 bind9-dnsutils_9.20.26-1~deb13u1_i386.deb
 a7a2d2ab49860fb9e85a2ee5c7f5a7578dad2e32c224f1b04fd837323c2c5e2c 93968 bind9-host-dbgsym_9.20.26-1~deb13u1_i386.deb
 80cd2775432c9c34f37c627b8b9724289cb0b50cbbed7b97bbd4c8f33c1a6ca5 58016 bind9-host_9.20.26-1~deb13u1_i386.deb
 fe61ddb0117c48bda755c49ea3ec373f0d60875bb49ba5f34e801427f81a5040 3540120 bind9-libs-dbgsym_9.20.26-1~deb13u1_i386.deb
 4de3ab1361dc1981b5757f9ae8794aaa213fce288fd27434d348ff74ea9d91a7 1327932 bind9-libs_9.20.26-1~deb13u1_i386.deb
 b5d5db42365b28700cf22d5b4b460e080ae9d9c061c24d4fc7218682d558ce55 449464 bind9-utils-dbgsym_9.20.26-1~deb13u1_i386.deb
 11a09ff3895a8e85d377d37030f17e1dc28beb448a9b0a23a15b691d579aad56 186284 bind9-utils_9.20.26-1~deb13u1_i386.deb
 9ef36def6cf3530fa287411fb6a7bd94de3e8cafff4ee211bf155d00e0a57f50 10460 bind9_9.20.26-1~deb13u1_i386-buildd.buildinfo
 aa14264c3a2ba70afaa59fdb2e369495782ddd25fff36baa5e2e7e256f466c7c 270736 bind9_9.20.26-1~deb13u1_i386.deb
Files:
 abbfabe646c365ffa7c7f490b8661501 611496 debug optional bind9-dbgsym_9.20.26-1~deb13u1_i386.deb
 ccee607d3e0f263d86fbbff7b4b5974e 296376 devel optional bind9-dev_9.20.26-1~deb13u1_i386.deb
 e166faa33d6889c97844ea0cbe5736d0 392492 debug optional bind9-dnsutils-dbgsym_9.20.26-1~deb13u1_i386.deb
 b6787809465e4fbc0569dbbf19138f6a 170628 net standard bind9-dnsutils_9.20.26-1~deb13u1_i386.deb
 0901bf1d9f0683bc9a8157bb06e860a5 93968 debug optional bind9-host-dbgsym_9.20.26-1~deb13u1_i386.deb
 4c605234e954f0ba83e9cdd10967db67 58016 net standard bind9-host_9.20.26-1~deb13u1_i386.deb
 56ddcaa2a5dd582ae9af581d3d998da2 3540120 debug optional bind9-libs-dbgsym_9.20.26-1~deb13u1_i386.deb
 724a0de699e0a27d447590614f640d77 1327932 libs standard bind9-libs_9.20.26-1~deb13u1_i386.deb
 22a43a446f8f7be12120df0815edbe7e 449464 debug optional bind9-utils-dbgsym_9.20.26-1~deb13u1_i386.deb
 bf50a88dc28207cdb1f0b0ea6e25cb0c 186284 net optional bind9-utils_9.20.26-1~deb13u1_i386.deb
 faf0a5375d2a3740c4e506dd9ec5b5bc 10460 net optional bind9_9.20.26-1~deb13u1_i386-buildd.buildinfo
 10567ddfcc66d85c9c10a5fe44ff4fc3 270736 net optional bind9_9.20.26-1~deb13u1_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmpfdzQACgkQbheoBegw
XLLhiBAAiTKkjIH+Iw8Q+Zq6eTW5DrXcwn13zVA1LptfceyEBa5T3/k+8tuqjFnM
rP0PdnaWkIKPSbJpKQt49DeJ+4dUbQX9TEEQFTuAtMsb3wPNYWHscRvysrN3+JWp
RuAa5DAYwV/DLgeZUHTs1+S3cfqRmshJbnBsuvrV5MQi8+iDAcI3Rt5mfQxCwCKm
4nuZN54Z9eLQYbCCBf8vQWIdFPkPiYQ67xeQeKXvcTLgx0QfBR1Gc5CPMJr5qSDB
DctcpvEU7a7NDH4cAIMY/6KICqhY96BPUg+5FtJ6iPKw0C7ZpAJsVzsmtKMe+dnD
CLEJkFcfJvBrRdMO4qcCfqFVvPP7lB0KEhhoE97iZwTT0cZ8GVeWfYb10A598Iwf
3x+KMU+Y7uZfmispm/ayMnfIpH0gJoiDPiy41bkyMcCtKK8vbuTp5Ntp7ZJetB4H
ULOfd2Ku1T7g9yVc6EF1iDkuVWxw+yCrmAD17IeoAydZ6aUlvS24l6Q0mDr3OLUe
7+v/HxCtNlEXqBtvmzRUOyXASHAH3KcWJvuDeQ5dG1Kc0ugW0smY9Izit4Ah0bvl
pPVXL22tNEFKpohb5nnr6+twRp3sJBsAkJsExEoFiec7YJuQic8rjnkTy2K4Fqcj
bttq10VM4jPBz7zt1gHtIQwnQw9zAnlHeKXRrNnZOnvAVAd+ycI=
=hFAh
-----END PGP SIGNATURE-----