bind9 bind 9.20.23

[Douglas R. Reno]

New point version. Following Xi's recommendations, I'll file a separate ticket for this one since it's another security update.

CVEs fixed include:

On 20 May 2026, Internet Systems Consortium disclosed six 
vulnerabilities affecting our BIND 9 software:

- CVE-2026-3039:        BIND 9 server memory exhaustion during GSS-API 
TKEY negotiation https://kb.isc.org/docs/cve-2026-3039
- CVE-2026-3592:        Amplification vulnerabilities via self-pointed 
glue records https://kb.isc.org/docs/cve-2026-3592
- CVE-2026-3593:        Heap use-after-free vulnerability in BIND 9 DNS-
over-HTTPS implementation https://kb.isc.org/docs/cve-2026-3593
- CVE-2026-5946:        Invalid handling of CLASS != IN 
https://kb.isc.org/docs/cve-2026-5946
- CVE-2026-5947:        SIG(0) validation during query flood may lead to 
undefined behavior https://kb.isc.org/docs/cve-2026-5947
- CVE-2026-5950:        Unbounded resend loop in BIND 9 resolver 
https://kb.isc.org/docs/cve-2026-5950

[pierre]

Shouldn't we close #23041, then? say, as "overcomebyevents", since none of the previous versions were in the book.

[Douglas R. Reno]

I'm going to reassign these to the book for now so whoever wants to do them can do them.

In the meantime I will continue working on rivendell, but I do not want to continue holding the project back on important issues.

[pierre]

release notes at ​https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html

[pierre]

Updated at aba6910d61. Leaving open for SA

[Bruce Dubbs]

Advisory sa-13.0-134 has been issued,