bind9 bind 9.20.23

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

Security Fixes

    Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)

    DNSSEC-signed zones may contain high iteration-count NSEC3 records, which prove that 
certain delegations are insecure. Previously, a validating resolver encountering such a 
delegation processed these iterations up to the number given, which could be a maximum 
of 65,535. This has been addressed by introducing a processing limit, set at 50. Now, if 
such an NSEC3 record is encountered, the delegation will be treated as insecure.

    ISC would like to thank Samy Medjahed/Ap4sh for bringing this vulnerability to our attention. [GL #5708]

    Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)

    An attacker controlling a DNSSEC-signed zone could trigger a memory leak in the 
logic preparing DNSSEC proofs of non-existence, by creating more than max-records-per-
type RRSIGs for NSEC records. These memory leaks have been fixed.

    ISC would like to thank Vitaly Simonovich for bringing this vulnerability to our attention. [GL #5742]

    Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)

    The named process could terminate unexpectedly when processing a correctly signed 
query containing a TKEY record. This has been fixed.

    ISC would like to thank Vitaly Simonovich for bringing this vulnerability to our attention. [GL #5748]

    Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)

    A stack use-after-return flaw in SIG(0) handling code could enable ACL bypass and/or 
assertion failures in certain circumstances. This flaw has been fixed.

    ISC would like to thank Mcsky23 for bringing this vulnerability to our attention. [GL #5754]

Bug Fixes

    Fix the handling of key statements defined inside views.

    A recent change introduced in BIND 9.20.17 hardened the key name check when used in 
primaries, to immediately reject the configuration if the key was not defined (rather 
than only checking whether the key name was correctly formed). However, that change 
introduced a regression that prevented the use of a key defined in a view. This has now 
been fixed. [GL #5761]

... and another security release tonight!

[Douglas R. Reno]

This one allows for unauthorized access and remotely exploitable crashes. Three of the issues are rated as High upstream, so to High we go.

[Bruce Dubbs]

Now version 9.20.23.

[Douglas R. Reno]

I'm going to reassign these to the book for now so whoever wants to do them can do them.

In the meantime I will continue working on rivendell, but I do not want to continue holding the project back on important issues.

[pierre]

There is a new ticket #23332 for 9.20.23, so closing this one (anyway, the initial version for which it has been opened is lost...).