bind9 bind 9.20.18

[Bruce Dubbs]

New point version.

[zeckma]

This release fixes a security vulnerability:

• CVE-2025-13878 (High): Fix incorrect length checks for BRID and HHIT records

[Bruce Dubbs]

Milestone renamed

[Douglas R. Reno]

The remainder of the release notes:

Security Fixes

Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

Malformed BRID and HHIT records could trigger an assertion failure. This has been fixed.

ISC would like to thank Vlatko Kosturjak from Marlink Cyber for bringing this 
vulnerability to our attention. [GL #5616]

Feature Changes

Add more information to the rndc recursing output about fetches.

This adds more information about active fetches, for debugging and diagnostic purposes. 
[GL !11305]

Bug Fixes

Make DNSSEC key rollovers more robust.

A manual rollover when the zone was in an invalid DNSSEC state caused predecessor 
keys to be removed too quickly. Additional safeguards to prevent this have been added: 
DNSSEC records are not removed from the zone until the underlying state machine has 
moved back into a valid DNSSEC state. [GL #5458]

Fix a catalog zone issue, where member zones could fail to load.

A catalog zone member zone could fail to load in some rare cases, when the 
internally generated zone configuration string exceeded 512 bytes. That condition by 
itself was not enough for the issue to arise, but it was necessary. This could happen 
if, for example, the catalog zone's default primary servers list contained a large 
number of items. This has been fixed. [GL #5658]

Allow glue in delegations with QTYPE=ANY.

When a query for type ANY triggered a delegation response, all additional data was 
omitted from the response, including mandatory glue. This has been fixed. [GL #5659]

Fix slow speed when signing a large delegation zone with NSEC3 opt-out.

BIND 9.20+ took much longer signing a large delegation zone with NSEC3 opt-out compared 
to version 9.18. This has been fixed. [GL #5672]

Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.

A zone that was signed with NSEC3, had opt-out enabled, and was then reconfigured to use 
NSEC, was published with missing NSEC records. This has been fixed. [GL #5679]

Fix a possible catalog zone issue during reconfiguration.

The named process could terminate unexpectedly during reconfiguration when a catalog 
zone update was taking place at the same time. This has been fixed. [GL !11366]

Fix the charts in the statistics channel.

The charts in the statistics channel could sometimes fail to render in the browser and 
were completely disabled for Mozilla-based browsers, for historical reasons. This has 
been fixed. [GL !11018]

[Douglas R. Reno]

Fixed at 115b172e32e48f263ed62388772ca40076692d8f

SA-12.4-082 issued