Public bug reported: A new release of bind9 is available for merging from Debian.
Ubuntu: 1:9.20.24-1ubuntu3 Debian Experimental: 1:9.21.26-1 Debian Unstable: 1:9.20.29-1 ### New Debian Changes ### bind9 (1:9.21.26-1) experimental; urgency=medium [ Bernhard Schmidt ] * Implement nodoc build profile (Closes: #1140938) * bind9-libs: Align priority with ftp-master (optional) (Closes: #1134744) [ Ondřej Surý ] * New upstream version 9.21.26 * Enable all unit tests again * Add named-wireformat manual page -- Ondřej Surý <[email protected]> Wed, 16 Sep 2026 15:22:05 +0200 bind9 (1:9.21.25-1) experimental; urgency=medium * New upstream version 9.21.25 * Add named-wireformat to the bind9 package -- Ondřej Surý <[email protected]> Wed, 19 Aug 2026 11:36:04 +0200 bind9 (1:9.21.24-1) experimental; urgency=medium * New upstream version 9.21.24 + [CVE-2026-10723]: Correct verification of NSEC3 signer name. + [CVE-2026-10822]: Malformed DNSKEY records could trigger an assertion. + [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns too-long name. + [CVE-2026-11605]: Prevent excessive validation work from crafted negative responses. + [CVE-2026-11622]: Prevent cache exhaustion under sustained attack. + [CVE-2026-11721]: Stop accepting invalid signed wildcard records. + [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME queries. + [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response. + [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. -- Ondřej Surý <[email protected]> Tue, 21 Jul 2026 18:07:16 +0200 bind9 (1:9.21.23-1) experimental; urgency=medium * New upstream version 9.21.23 * Add missing synthrecord.8 man page * Add deleg test to flaky test suite -- Ondřej Surý <[email protected]> Wed, 17 Jun 2026 14:55:33 +0200 bind9 (1:9.21.22-1) experimental; urgency=high * New upstream version 9.21.22 + [CVE-2026-3592]: Limit resolver server list size. + [CVE-2026-3039]: Fix GSS-API resource leak. + [CVE-2026-5946]: Disable recursion, UPDATE, and NOTIFY for non-IN views. + [CVE-2026-5950]: Avoid unbounded recursion loop. + [CVE-2026-5947]: Fix crash in resolver when SIG(0)-signed responses are received under load. + [CVE-2026-3593]: Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. * Add missing synthrecord.8 man page * Add deleg test to flaky test suite -- Ondřej Surý <[email protected]> Wed, 20 May 2026 12:45:38 +0200 bind9 (1:9.21.21-1) experimental; urgency=medium * New upstream version 9.21.21 -- Ondřej Surý <[email protected]> Wed, 01 Apr 2026 17:36:37 +0200 bind9 (1:9.21.20-1) experimental; urgency=medium * New upstream version 9.21.20 - [CVE-2026-1519]: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. - [CVE-2026-3104]: Fix memory leaks in code preparing DNSSEC proofs of non-existence. - [CVE-2026-3119]: Prevent a crash in code processing queries containing a TKEY record. - [CVE-2026-3591]: Fix a stack use-after-return flaw in SIG(0) handling code. -- Ondřej Surý <[email protected]> Wed, 25 Mar 2026 16:45:08 +0100 bind9 (1:9.21.19-1) experimental; urgency=medium * New upstream version 9.21.19 -- Ondřej Surý <[email protected]> Fri, 27 Feb 2026 12:50:35 +0100 bind9 (1:9.21.18-1) experimental; urgency=medium * New upstream version 9.21.18 -- Ondřej Surý <[email protected]> Wed, 18 Feb 2026 12:56:41 +0100 bind9 (1:9.21.17-1) experimental; urgency=medium * New upstream version 9.21.17 + [CVE-2025-13878]: Fix incorrect length checks for BRID and HHIT records. -- Ondřej Surý <[email protected]> Wed, 21 Jan 2026 16:58:27 +0100 bind9 (1:9.21.16-1) experimental; urgency=medium * New upstream version 9.21.16 -- Ondřej Surý <[email protected]> Wed, 17 Dec 2025 16:58:59 +0100 bind9 (1:9.21.15-3) experimental; urgency=medium * Bump meson B-D to >= 1.3.0~ -- Ondřej Surý <[email protected]> Thu, 20 Nov 2025 11:56:24 +0100 bind9 (1:9.21.15-2) experimental; urgency=medium * Fix the sphinx doc build -- Ondřej Surý <[email protected]> Wed, 19 Nov 2025 23:15:26 +0100 bind9 (1:9.21.15-1) experimental; urgency=medium * New upstream version 9.21.15 * libcap is mandatory on Linux, remove it from meson invocation * Remove RPATH from synthrecord plugin -- Ondřej Surý <[email protected]> Wed, 19 Nov 2025 22:10:30 +0100 bind9 (1:9.21.14-3) experimental; urgency=medium * Add upstream patches to prevent assertion failure when caching RRSIG for non-existent record. -- Ondřej Surý <[email protected]> Sun, 09 Nov 2025 00:13:24 +0100 bind9 (1:9.21.14-2) experimental; urgency=medium * Remove libdb-dev build depends (Closes: #1119196) -- Ondřej Surý <[email protected]> Tue, 28 Oct 2025 07:39:26 +0100 bind9 (1:9.21.14-1) experimental; urgency=medium * New upstream version 9.21.14 - [CVE-2025-8677]: DNSSEC validation fails if matching but invalid DNSKEY is found - [CVE-2025-40778]: Address various spoofing attacks. - [CVE-2025-40780]: Cache-poisoning due to weak pseudo-random number generator -- Ondřej Surý <[email protected]> Wed, 22 Oct 2025 17:04:56 +0200 bind9 (1:9.21.12-1) experimental; urgency=medium * New upstream version 9.21.12 * Don't fail build on failed tests (yet) -- Ondřej Surý <[email protected]> Wed, 10 Sep 2025 20:36:14 +0200 bind9 (1:9.21.11-2) experimental; urgency=medium * Also install named-makejournal man page -- Ondřej Surý <[email protected]> Wed, 20 Aug 2025 20:07:47 +0200 bind9 (1:9.21.11-1) experimental; urgency=medium * New upstream version 9.21.11 -- Ondřej Surý <[email protected]> Wed, 20 Aug 2025 17:44:21 +0200 bind9 (1:9.21.10-10) experimental; urgency=medium * Disable the flaky tests * Bump the debhelper compat level to 13 to use meson test -- Ondřej Surý <[email protected]> Tue, 05 Aug 2025 11:08:45 +0200 bind9 (1:9.21.10-9) experimental; urgency=medium * Reduce the stack size to make the unit tests work on 32-bits -- Ondřej Surý <[email protected]> Tue, 05 Aug 2025 09:42:34 +0200 bind9 (1:9.21.10-8) experimental; urgency=medium * Skip the benchmarks in the CI -- Ondřej Surý <[email protected]> Sun, 27 Jul 2025 17:18:08 +0200 bind9 (1:9.21.10-7) experimental; urgency=medium * Reduce the number of ISC_TASK_WORKERS to speed up unit tests -- Ondřej Surý <[email protected]> Sun, 27 Jul 2025 12:13:53 +0200 bind9 (1:9.21.10-6) experimental; urgency=medium * Split the arch and indep build rules, so non-amd64 builds can succeed -- Ondřej Surý <[email protected]> Sun, 27 Jul 2025 07:30:16 +0200 bind9 (1:9.21.10-5) experimental; urgency=medium * Install named.conf.root-hints instead of named.conf.default-zones -- Ondřej Surý <[email protected]> Sun, 27 Jul 2025 06:31:19 +0200 bind9 (1:9.21.10-4) experimental; urgency=medium * Adjust the dependency on meson to be >= 0.61 -- Ondřej Surý <[email protected]> Thu, 17 Jul 2025 14:46:05 +0200 bind9 (1:9.21.10-3) experimental; urgency=medium * Disable ns_query test for now -- Ondřej Surý <[email protected]> Thu, 17 Jul 2025 13:54:19 +0200 bind9 (1:9.21.10-2) experimental; urgency=medium * Make the ns_query test flaky -- Ondřej Surý <[email protected]> Thu, 17 Jul 2025 13:25:44 +0200 bind9 (1:9.21.10-1) experimental; urgency=medium * New upstream version 9.21.10 * Add support for meson build system * Remove bind9-dev package, there are no headers * Install named-makejournal to bind9-utils -- Ondřej Surý <[email protected]> Wed, 16 Jul 2025 20:22:56 +0200 bind9 (1:9.21.9-1) experimental; urgency=medium * New upstream version 9.21.9 -- Ondřej Surý <[email protected]> Fri, 20 Jun 2025 06:29:50 +0200 bind9 (1:9.21.8-1) experimental; urgency=high [ Ondřej Surý ] * New upstream version 9.21.8 + [CVE-2025-40775] Prevent assertion when processing TSIG algorithm. * Fix lintian mismatched-override * Use pkgconf instead of pkg-config * Remove superfluous-file-pattern(s) from d/copyright * Remove full path to named-checkconf in d/bind9.postinst * Adjust the autopkg zonetest [ Remus-Gabriel Chelu ] * [INTL:ro] Romanian debconf templates translation of bind9 -- Ondřej Surý <[email protected]> Wed, 21 May 2025 13:47:25 +0200 bind9 (1:9.21.7-2) experimental; urgency=medium [ Ondřej Surý ] * Validate configuration file before service restart (Closes: #995310) [ Lena Voytek ] * Fix German UTF-8 encoding * Clean up debian/copyright file * Remove lsb-base runtime dependency as it is no longer needed * Add zonetest DEP-8 test [ Santiago Ruano Rincón ] * Add debian/salsa-ci.yml * Make d/tests/validation less flaky. [ Carles Pina i Estany ] * Added po-debconf Catalan translation [ Mitchell Dzurick ] * d/control: Suggest bind9-doc over bind-doc for the bind9 package [ Debian Janitor ] * Apply multi-arch hints. + bind9-doc: Add Multi-Arch: foreign. -- Ondřej Surý <[email protected]> Thu, 17 Apr 2025 21:19:58 +0200 bind9 (1:9.21.7-1) experimental; urgency=medium * New upstream version 9.21.7 -- Ondřej Surý <[email protected]> Wed, 16 Apr 2025 15:20:49 +0200 bind9 (1:9.21.6-1) experimental; urgency=medium * New upstream version 9.21.6 -- Ondřej Surý <[email protected]> Thu, 13 Mar 2025 11:37:33 +0100 bind9 (1:9.21.5-1) experimental; urgency=medium * New upstream version 9.21.5 * Drop libltdl-dev from Build-Depends, libuv is used * Drop transitional package dnsutils (Closes: #1038223) * Drop transitional package bind9utils (Closes: #1038222) * Use command -v resolvconf to check if it is installed (Closes: #1090804) * Add NEWS item about zone transfer ACL change (Closes: #1076674) * Remove obsolete empty-zones configuration files * Remove obsolete empty-zones configuration files * Add Debian NEWS about sd_notify socket (Closes: #1037966) * Set Multi-Arch: foreign on bind9-host and dnsutils (Closes: #907804) -- Ondřej Surý <[email protected]> Wed, 19 Feb 2025 16:01:56 +0100 bind9 (1:9.21.4-1) experimental; urgency=medium * New upstream version 9.21.4 -- Ondřej Surý <[email protected]> Mon, 27 Jan 2025 13:08:58 +0100 bind9 (1:9.21.3-1) experimental; urgency=medium * New upstream version 9.21.3 * Add testing patch for GLUE cache implementation -- Ondřej Surý <[email protected]> Wed, 11 Dec 2024 17:51:26 +0100 bind9 (1:9.21.2-302-gebe0db5daad-1) experimental; urgency=medium * Remove paths from common binaries found in {/usr,}{/bin,/sbin} (Closes: #1055429) * New upstream snapshot 9.21.2-302-gebe0db5daad -- Ondřej Surý <[email protected]> Sun, 08 Dec 2024 14:43:41 +0100 bind9 (1:9.21.2-1) experimental; urgency=medium * New upstream version 9.21.2 -- Ondřej Surý <[email protected]> Thu, 10 Oct 2024 10:39:06 +0200 bind9 (1:9.21.1-1) experimental; urgency=medium * New upstream version 9.21.1 -- Ondřej Surý <[email protected]> Fri, 20 Sep 2024 14:39:28 +0200 bind9 (1:9.21.0-1) experimental; urgency=medium * Update for BIND 9.21 major branch * New upstream version 9.21.0 -- Ondřej Surý <[email protected]> Wed, 21 Aug 2024 15:15:06 +0200 ### Old Ubuntu Delta ### bind9 (1:9.20.24-1ubuntu3) stonking; urgency=medium * SECURITY UPDATE: Incorrect acceptance of NSEC3 records - debian/patches/CVE-2026-10723-1.patch: Check NSEC3 signer matches the owning zone in lib/dns/dnssec.c, lib/isc/result.c. - debian/patches/CVE-2026-10723-2.patch: Reproducer for #5874 NSEC3 impersonation in bin/tests/system/repro_5874_nsec3_parent/ans1/ans.py, bin/tests/system/repro_5874_nsec3_parent/ns2/named.conf.j2, bin/tests/system/repro_5874_nsec3_parent/server.py, bin/tests/system/repro_5874_nsec3_parent/tests_repro_5874_nsec3_parent.py. - debian/patches/CVE-2026-10723-3.patch: Update reproducer #5874 in bin/tests/system/nsec3_impersonation/ans1/ans.py, bin/tests/system/nsec3_impersonation/ns2/named.conf.j2, bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py. - CVE-2026-10723 * SECURITY UPDATE: Key Record using PRIVATEDNS algorithm may lead to unexpected exit - debian/patches/CVE-2026-10822-1.patch: Check that dns_name_fromwire honours the active region in tests/dns/name_test.c. - debian/patches/CVE-2026-10822-2.patch: Fix the yaml query zone name code in dnstap-read in bin/tools/dnstap-read.c. - debian/patches/CVE-2026-10822-3.patch: Fix dns_name_fromwire to honour the active region in lib/dns/name.c. - debian/patches/CVE-2026-10822-4.patch: Make it clearer that decompression is not allowed here in lib/dns/rdata.c. - debian/patches/CVE-2026-10822-5.patch: Check that a short PRIVATEDNS record is rejected in tests/dns/rdata_test.c. - CVE-2026-10822 * SECURITY UPDATE: Potential wildcard CNAME RPZ policy bypass - debian/patches/CVE-2026-11331-1.patch: Fix TTL extraction from A/AAAA record in bin/tests/system/rpz/tests.sh. - debian/patches/CVE-2026-11331-2.patch: Check rpz name too long wildcard CNAME expansion handling in bin/tests/system/rpz/ns2/tld2.db, bin/tests/system/rpz/ns4/tld4.db, bin/tests/system/rpz/tests.sh. - debian/patches/CVE-2026-11331-3.patch: Properly handle rpz name to long wildcard expansion in lib/ns/query.c. - CVE-2026-11331 * SECURITY UPDATE: Unnecessary validation of DNSSEC signed records - debian/patches/CVE-2026-11605-1.patch: Limit DNSSEC denial proof validation per fetch in lib/dns/validator.c. - CVE-2026-11605 * SECURITY UPDATE: Potential memory usage beyond configured limits - debian/patches/CVE-2026-11622.patch: Make the dns_slabheaders in the cache reference counted in bin/tests/system/reclimit/tests.sh, lib/dns/include/dns/rdataslab.h, lib/dns/qpcache.c, lib/dns/qpzone.c, lib/dns/rbt-cachedb.c, lib/dns/rbtdb.c, lib/dns/rbtdb_p.h, lib/dns/rdataslab.c. - CVE-2026-11622 * SECURITY UPDATE: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards - debian/patches/CVE-2026-11721-1.patch: Don't sign out of zone records in dnssec-signzone in bin/dnssec/dnssec-signzone.c. - debian/patches/CVE-2026-11721-2.patch: Invalid signed wildcard records were being accepted in lib/dns/dnssec.c, lib/dns/rdata/generic/rrsig_46.c. - debian/patches/CVE-2026-11721-3.patch: Test RRSIG record parsing in tests/dns/rdata_test.c. - CVE-2026-11721 * SECURITY UPDATE:Record ordering based unexpected exit with CNAME or DNAME - debian/patches/CVE-2026-12617-1.patch: Do not assert in some CNAME/DNAME queries in lib/dns/resolver.c. - debian/patches/CVE-2026-12617-2.patch: Reproducer for #5946 (assertion in some CNAME/DNAME queries) in bin/tests/system/cname_dname_negcache/ans2/ans.py, bin/tests/system/cname_dname_negcache/ns1/bar.test.db, bin/tests/system/cname_dname_negcache/ns1/named.conf.j2, bin/tests/system/cname_dname_negcache/ns1/root.db, bin/tests/system/cname_dname_negcache/ns1/test.db, bin/tests/system/cname_dname_negcache/ns3/named.conf.j2, bin/tests/system/cname_dname_negcache/tests_cname_dname_negcache.py. - CVE-2026-12617 * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3 both present - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3 in lib/dns/qpcache.c, lib/dns/rbtdb.c, lib/dns/rdatalist.c, lib/dns/resolver.c, lib/ns/query.c. - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname mismatch in bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py, bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2, bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_ runtime_check.py. - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py, bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/ system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py. - CVE-2026-13204 * SECURITY UPDATE: Record ordering based unexpected exit with CNAME or DNAME - debian/patches/CVE-2026-13321-1.patch: Add system test for out-of-zone nsec dnssec bypass in bin/tests/system/dnssec_bypass/ns1/named.conf.j2, bin/tests/system/dnssec_bypass/ns1/root.db, bin/tests/system/dnssec_bypass/ns1/test.db, bin/tests/system/dnssec_bypass/ns2/named.conf.j2, bin/tests/system/dnssec_bypass/ns2/victim.db, bin/tests/system/dnssec_bypass/ns3/evil.db, bin/tests/system/dnssec_bypass/ns3/named.conf.j2, bin/tests/system/dnssec_bypass/ns4/named.conf.j2, bin/tests/system/dnssec_bypass/tests_bypass.py. - debian/patches/CVE-2026-13321-2.patch: Reject out-of-zone NSEC next owner names in lib/dns/dnssec.c, lib/dns/include/dns/dnssec.h. - debian/patches/CVE-2026-13321-3.patch: change dns_nsec_requiredtypespresent to dns_nsec_is_legal in lib/dns/include/dns/nsec.h, lib/dns/nsec.c, lib/dns/resolver.c, lib/ns/query.c. - CVE-2026-13321 -- Marc Deslauriers <[email protected]> Mon, 31 Aug 2026 12:10:28 -0400 bind9 (1:9.20.24-1ubuntu2) stonking; urgency=medium * No-change rebuild against libssl4 -- Ravi Kant Sharma <[email protected]> Fri, 24 Jul 2026 10:28:57 +0000 bind9 (1:9.20.24-1ubuntu1) stonking; urgency=medium * Merge with Debian unstable (LP: #2157486). Remaining changes: - Don't build dnstap as it depends on universe packages: + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and protobuf-c-compiler + d/dnsutils.install: don't install dnstap + d/rules: don't build dnstap nor install dnstap.proto - Add back apport: + d/bind9.apport: add back old bind9 apport hook, but without calling attach_conffiles() since that is already done by apport itself, with confirmation from the user. + d/control, d/rules: build-depends on dh-apport and use it - d/NEWS: mention relevant packaging changes - d/e/apparmor.d/usr.sbin.named: Allow read access to /proc/version_signature for named (LP #2119320) -- Lena Voytek <[email protected]> Thu, 18 Jun 2026 12:22:05 -0400 bind9 (1:9.20.24-1) unstable; urgency=medium * New upstream version 9.20.24 -- Ondřej Surý <[email protected]> Wed, 17 Jun 2026 14:43:58 +0200 bind9 (1:9.20.23-1ubuntu1) stonking; urgency=medium * Merge with Debian unstable (LP: #2154096). Remaining changes: - Don't build dnstap as it depends on universe packages: + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and protobuf-c-compiler + d/dnsutils.install: don't install dnstap + d/rules: don't build dnstap nor install dnstap.proto - Add back apport: + d/bind9.apport: add back old bind9 apport hook, but without calling attach_conffiles() since that is already done by apport itself, with confirmation from the user. + d/control, d/rules: build-depends on dh-apport and use it - d/NEWS: mention relevant packaging changes - d/e/apparmor.d/usr.sbin.named: Allow read access to /proc/version_signature for named (LP #2119320) * Drop Changes: - d/bind9.maintscript: rm_conffile for incompatible named.conf (LP #2150582) [Uploaded by mistake in 1:9.20.18-1ubuntu3] - d/p/CVE-2026-1519-1.patch - d/p/CVE-2026-1519-2.patch - d/p/CVE-2026-1519-3.patch - d/p/CVE-2026-1519-4.patch - d/p/CVE-2026-1519-5.patch - d/p/CVE-2026-3104-1.patch - d/p/CVE-2026-3104-2.patch - d/p/CVE-2026-3119-1.patch - d/p/CVE-2026-3119-2.patch - d/p/CVE-2026-3591-1.patch - d/p/CVE-2026-3591-2.patch [Fixed in 9.20.21] - d/p/CVE-2026-3039-pre1.patch - d/p/CVE-2026-3039-1.patch - d/p/CVE-2026-3039-3.patch - d/p/CVE-2026-3592-1.patch - d/p/CVE-2026-3592-2.patch - d/p/CVE-2026-3592-3.patch - d/p/CVE-2026-3592-4.patch - d/p/CVE-2026-3593-1.patch - d/p/CVE-2026-3593-2.patch - d/p/CVE-2026-5946-1.patch - d/p/CVE-2026-5946-2.patch - d/p/CVE-2026-5946-3.patch - d/p/CVE-2026-5946-4.patch - d/p/CVE-2026-5946-5.patch - d/p/CVE-2026-5946-6.patch - d/p/CVE-2026-5946-7.patch - d/p/CVE-2026-5946-8.patch - d/p/CVE-2026-5946-9.patch - d/p/CVE-2026-5947.patch - d/p/CVE-2026-5950-1.patch - d/p/CVE-2026-5950-2.patch - d/p/CVE-2026-5950-3.patch [Fixed in 9.20.23] -- Lena Voytek <[email protected]> Thu, 28 May 2026 14:49:56 -0400 bind9 (1:9.20.23-1) unstable; urgency=high * New upstream version 9.20.23 + [CVE-2026-3592]: Limit resolver server list size. + [CVE-2026-3039]: Fix GSS-API resource leak. + [CVE-2026-5946]: Disable recursion, UPDATE, and NOTIFY for non-IN views. + [CVE-2026-5950]: Avoid unbounded recursion loop. + [CVE-2026-5947]: Fix crash in resolver when SIG(0)-signed responses are received under load. + [CVE-2026-3593]: Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. -- Ondřej Surý <[email protected]> Wed, 20 May 2026 11:42:43 +0200 bind9 (1:9.20.22-1) unstable; urgency=medium * New upstream version 9.20.22 -- Ondřej Surý <[email protected]> Wed, 01 Apr 2026 16:58:56 +0200 bind9 (1:9.20.21-1) unstable; urgency=high * New upstream version 9.20.21 - [CVE-2026-1519]: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. - [CVE-2026-3104]: Fix memory leaks in code preparing DNSSEC proofs of non-existence. - [CVE-2026-3119]: Prevent a crash in code processing queries containing a TKEY record. - [CVE-2026-3591]: Fix a stack use-after-return flaw in SIG(0) handling code. -- Ondřej Surý <[email protected]> Wed, 25 Mar 2026 16:38:18 +0100 bind9 (1:9.20.20-1) unstable; urgency=medium * New upstream version 9.20.20 -- Ondřej Surý <[email protected]> Fri, 27 Feb 2026 12:46:48 +0100 bind9 (1:9.20.19-1) unstable; urgency=medium * New upstream version 9.20.19 -- Ondřej Surý <[email protected]> Wed, 18 Feb 2026 12:28:29 +0100 bind9 (1:9.20.18-1ubuntu4) stonking; urgency=medium * SECURITY UPDATE: BIND 9 server memory exhaustion during GSS-API TKEY negotiation - debian/patches/CVE-2026-3039-pre1.patch: Release gnamebuf also on the error path in lib/dns/gssapictx.c. - debian/patches/CVE-2026-3039-1.patch: Fix GSS-API context leak in TKEY negotiation in lib/dns/gssapictx.c, lib/dns/include/dst/gssapi.h, lib/dns/tkey.c. - debian/patches/CVE-2026-3039-3.patch: Fix output token and GSS context leaks in TKEY/GSS-API error paths in lib/dns/gssapictx.c, lib/dns/tkey.c. - CVE-2026-3039 * SECURITY UPDATE: Amplification vulnerabilities via self-pointed glue records - debian/patches/CVE-2026-3592-1.patch: Limit the number of addresses returned per ADB find in bin/named/main.c, lib/dns/adb.c. - debian/patches/CVE-2026-3592-2.patch: Remove duplicate addresses from the resolver SLIST in lib/dns/resolver.c. - debian/patches/CVE-2026-3592-3.patch: Add system test for self-pointed glue deduplication in bin/tests/system/selfpointedglue/ns1/named.conf.j2, bin/tests/system/selfpointedglue/ns1/root.db, bin/tests/system/selfpointedglue/ns2/named.conf.j2, bin/tests/system/selfpointedglue/ns2/tld.db, bin/tests/system/selfpointedglue/ns3/example.tld.db, bin/tests/system/selfpointedglue/ns3/example2.tld.db, bin/tests/system/selfpointedglue/ns3/named.conf.j2, bin/tests/system/selfpointedglue/ns4/named.args.j2, bin/tests/system/selfpointedglue/ns4/named.conf.j2, bin/tests/system/selfpointedglue/ns4/root.hint, bin/tests/system/selfpointedglue/tests_selfpointedglue.py. - debian/patches/CVE-2026-3592-4.patch: Add SRTT-based server selection system test in bin/tests/system/srtt/README, bin/tests/system/srtt/ans2/ans.py, bin/tests/system/srtt/ans3/ans.py, bin/tests/system/srtt/ans4/ans.py, bin/tests/system/srtt/ans5/ans.py, bin/tests/system/srtt/ns1/named.conf.j2, bin/tests/system/srtt/ns1/root.db, bin/tests/system/srtt/ns6/named.args, bin/tests/system/srtt/ns6/named.conf.j2, bin/tests/system/srtt/srtt_ans.py, bin/tests/system/srtt/tests_srtt.py. - CVE-2026-3592 * SECURITY UPDATE: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation - debian/patches/CVE-2026-3593-1.patch: Add system test for HTTP/2 SETTINGS frame flood in bin/tests/system/doth/tests_malicious.py. - debian/patches/CVE-2026-3593-2.patch: Fix use-after-free in DoH write buffer after HTTP/2 send in lib/isc/netmgr/http.c. - CVE-2026-3593 * SECURITY UPDATE: Invalid handling of CLASS != IN - debian/patches/CVE-2026-5946-1.patch: Disable recursion for non-IN classes in bin/named/server.c, lib/isccfg/check.c. - debian/patches/CVE-2026-5946-2.patch: Disable UPDATE and NOTIFY for non-IN classes in bin/named/server.c, lib/dns/adb.c, lib/ns/client.c, lib/ns/update.c. - debian/patches/CVE-2026-5946-3.patch: Validate DNS message CLASS early in request processing in bin/tests/system/unknown/tests.sh, lib/ns/client.c. - debian/patches/CVE-2026-5946-4.patch: Reject meta-classes in UPDATE and NOTIFY messages in lib/dns/message.c. - debian/patches/CVE-2026-5946-5.patch: Skip "deny-answer-address" for non-IN addresses in lib/dns/resolver.c. - debian/patches/CVE-2026-5946-6.patch: Test CHAOS view recursion behavior in bin/tests/system/checkconf/tests.sh, bin/tests/system/checkconf/warn-chaos-recursion.conf, bin/tests/system/class/ns1/chaos.db.in, bin/tests/system/class/ns1/named.conf.j2, bin/tests/system/class/ns2/example.db.in, bin/tests/system/class/ns2/localhost.db.in, bin/tests/system/class/ns2/named.conf.j2, bin/tests/system/class/ns3/named.conf.j2, bin/tests/system/class/setup.sh, bin/tests/system/class/tests_class_chaos.py, bin/tests/system/isctest/check.py. - debian/patches/CVE-2026-5946-7.patch: Test UPDATE behavior in CHAOS and other non-IN classes in bin/named/server.c, bin/tests/system/class/ns2/localhost.db.in, bin/tests/system/class/tests_class_update.py. - debian/patches/CVE-2026-5946-8.patch: Test server behavior when sending various UPDATE requests in bin/tests/system/class/tests_class_update.py, bin/tests/system/nsupdate/setup.sh, bin/tests/system/nsupdate/tests.sh, bin/tests/system/packet.pl. - debian/patches/CVE-2026-5946-9.patch: Make the RD flag optional in isctest.query() in bin/tests/system/isctest/query.py. - CVE-2026-5946 * SECURITY UPDATE: SIG(0) validation during query flood may lead to undefined behavior - debian/patches/CVE-2026-5947.patch: Fix use-after-free in resolver SIG(0) async verification path in lib/dns/resolver.c. - CVE-2026-5947 * SECURITY UPDATE: Unbounded resend loop in BIND 9 resolver - debian/patches/CVE-2026-5950-1.patch: Add reproducer for BADCOOKIE resend loop in bin/tests/system/resend_loop/ans3/ans.py, bin/tests/system/resend_loop/ns4/named.conf.j2, bin/tests/system/resend_loop/ns4/root.hint, bin/tests/system/resend_loop/tests_resend_loop.py. - debian/patches/CVE-2026-5950-2.patch: Refactor incrementing query counters in lib/dns/resolver.c. - debian/patches/CVE-2026-5950-3.patch: rctx_resend() increment query counters in lib/dns/resolver.c. - CVE-2026-5950 * d/p/CVE-2026-1519-1.patch, d/p/CVE-2026-3104-1.patch: disable patches, quilt doesn't like patches that create symlinks apparently. -- Marc Deslauriers <[email protected]> Thu, 21 May 2026 08:23:48 -0400 bind9 (1:9.20.18-1ubuntu3) stonking; urgency=medium * d/bind9.maintscript: rm_conffile for incompatible named.conf (LP: #2150582) -- Hector Cao <[email protected]> Thu, 30 Apr 2026 16:36:00 +0200 bind9 (1:9.20.18-1ubuntu2) resolute; urgency=medium * SECURITY UPDATE: Excessive NSEC3 iterations cause high CPU load during insecure delegation validation - debian/patches/CVE-2026-1519-1.patch: add reproducers to bin/tests/*. - debian/patches/CVE-2026-1519-2.patch: check iterations in isdelegation() in lib/dns/validator.c. - debian/patches/CVE-2026-1519-3.patch: don't verify already trusted rdatasets in lib/dns/include/dns/types.h, lib/dns/validator.c. - debian/patches/CVE-2026-1519-4.patch: combine validator_log and marksecure in lib/dns/validator.c. - debian/patches/CVE-2026-1519-5.patch: check RRset trust in validate_neg_rrset() in lib/dns/validator.c. - CVE-2026-1519 * SECURITY UPDATE: Memory leak in code preparing DNSSEC proofs of non-existence - debian/patches/CVE-2026-3104-1.patch: add tests to bin/tests/*. - debian/patches/CVE-2026-3104-2.patch: fix memory leak in QPcache addnoqname/addclosest mechanism in lib/dns/qpcache.c, lib/dns/rbtdb.c. - CVE-2026-3104 * SECURITY UPDATE: Authenticated query containing a TKEY record may cause named to terminate unexpectedly - debian/patches/CVE-2026-3119-1.patch: add tests to bin/tests/*. - debian/patches/CVE-2026-3119-2.patch: fix a bug in dns_tkey_processquery() in lib/dns/tkey.c. - CVE-2026-3119 * SECURITY UPDATE: A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass - debian/patches/CVE-2026-3591-1.patch: add tests to bin/tests/*. - debian/patches/CVE-2026-3591-2.patch: fix stack Use-After-Return in SIG(0) handling in bin/named/server.c. - CVE-2026-3591 -- Marc Deslauriers <[email protected]> Fri, 27 Mar 2026 11:00:11 -0400 bind9 (1:9.20.18-1ubuntu1) resolute; urgency=medium * Merge with Debian unstable (LP: #2125995). Remaining changes: - Don't build dnstap as it depends on universe packages: + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and protobuf-c-compiler + d/dnsutils.install: don't install dnstap + d/rules: don't build dnstap nor install dnstap.proto - Add back apport: + d/bind9.apport: add back old bind9 apport hook, but without calling attach_conffiles() since that is already done by apport itself, with confirmation from the user. + d/control, d/rules: build-depends on dh-apport and use it - d/NEWS: mention relevant packaging changes * Drop Changes: - d/p/CVE-2025-8677.patch - d/p/CVE-2025-40778.patch - d/p/CVE-2025-40780.patch [Fixed in 9.20.15] * Added: - d/e/apparmor.d/usr.sbin.named: Allow read access to /proc/version_signature for named (LP: #2119320). -- Lena Voytek <[email protected]> Fri, 06 Feb 2026 16:05:33 -0500 bind9 (1:9.20.18-1) unstable; urgency=medium * New upstream version 9.20.18 + [CVE-2025-13878]: Fix incorrect length checks for BRID and HHIT records. -- Ondřej Surý <[email protected]> Wed, 21 Jan 2026 16:47:34 +0100 bind9 (1:9.20.17-1) unstable; urgency=medium * New upstream version 9.20.17 -- Ondřej Surý <[email protected]> Wed, 17 Dec 2025 16:32:20 +0100 bind9 (1:9.20.16-1) unstable; urgency=medium * New upstream version 9.20.16 -- Ondřej Surý <[email protected]> Wed, 19 Nov 2025 18:06:11 +0100 bind9 (1:9.20.15-2) unstable; urgency=medium * Remove libdb-dev build depends (Closes: #1119196) -- Ondřej Surý <[email protected]> Tue, 28 Oct 2025 07:28:58 +0100 bind9 (1:9.20.15-1) unstable; urgency=medium * New upstream version 9.20.15 - [CVE-2025-8677]: DNSSEC validation fails if matching but invalid DNSKEY is found - [CVE-2025-40778]: Address various spoofing attacks. - [CVE-2025-40780]: Cache-poisoning due to weak pseudo-random number generator -- Ondřej Surý <[email protected]> Wed, 22 Oct 2025 16:40:20 +0200 bind9 (1:9.20.13-1) unstable; urgency=medium * New upstream version 9.20.13 -- Ondřej Surý <[email protected]> Wed, 10 Sep 2025 20:31:08 +0200 bind9 (1:9.20.12-1) unstable; urgency=medium * New upstream version 9.20.12 -- Ondřej Surý <[email protected]> Wed, 20 Aug 2025 17:22:43 +0200 bind9 (1:9.20.11-4) unstable; urgency=medium * Remove named.conf.default-zones.dpkg-dist from /etc/bind -- Ondřej Surý <[email protected]> Sun, 27 Jul 2025 12:04:56 +0200 bind9 (1:9.20.11-3) unstable; urgency=medium * Remove the /etc/bind/named.conf.default-zones again from the maintainer script as it might have been reinstalled by accident. (Closes: #1108945) -- Ondřej Surý <[email protected]> Sun, 27 Jul 2025 07:54:24 +0200 bind9 (1:9.20.11-2) unstable; urgency=high * Remove /etc/bind/named.conf.default-zones from the package as the intent was to remove this file. (Closes: #1108945) * Add new /etc/bind/named.conf.root-hints file that makes 'named' to use root.hints from dns-root-data again. -- Ondřej Surý <[email protected]> Sun, 27 Jul 2025 06:48:59 +0200 bind9 (1:9.20.11-1ubuntu3) resolute; urgency=medium * SECURITY UPDATE: Resource exhaustion via malformed DNSKEY handling - debian/patches/CVE-2025-8677.patch: count invalid keys as validation failures in lib/dns/validator.c. - CVE-2025-8677 * SECURITY UPDATE: Cache poisoning attacks with unsolicited RRs - debian/patches/CVE-2025-40778.patch: no longer accept DNAME records or extraneous NS records in the AUTHORITY section unless these are received via spoofing-resistant transport in doc/arm/reference.rst, lib/dns/include/dns/message.h, lib/dns/message.c, lib/dns/resolver.c. - CVE-2025-40778 * SECURITY UPDATE: Cache poisoning due to weak PRNG - debian/patches/CVE-2025-40780.patch: change internal random generator to a cryptographically secure pseudo-random generator in configure.ac, lib/isc/Makefile.am, lib/isc/hash.c, lib/isc/hashmap.c, lib/isc/include/isc/nonce.h, lib/isc/include/isc/random.h, lib/isc/random.c, tests/isc/random_test.c. - CVE-2025-40780 -- Marc Deslauriers <[email protected]> Tue, 21 Oct 2025 07:57:20 -0400 bind9 (1:9.20.11-1ubuntu2) questing; urgency=medium * Rebuild to include updated RISC-V base ISA RVA23 -- Heinrich Schuchardt <[email protected]> Wed, 03 Sep 2025 15:03:19 +0000 bind9 (1:9.20.11-1ubuntu1) questing; urgency=medium * Merge with Debian unstable. Remaining changes: - Don't build dnstap as it depends on universe packages: + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and protobuf-c-compiler (universe packages) + d/dnsutils.install: don't install dnstap + d/rules: don't build dnstap nor install dnstap.proto - Add back apport: + d/bind9.apport: add back old bind9 apport hook, but without calling attach_conffiles() since that is already done by apport itself, with confirmation from the user. + d/control, d/rules: build-depends on dh-apport and use it - d/NEWS: mention relevant packaging changes * Drop changes: - dyndb-ldap test: bind-dyndb-ldap likely will not return to the archive, and if it is this test can be re-added manually: + d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650) + d/t/control: Disable dyndb-ldap test as bind-dyndb-ldap has been removed from Ubuntu for now (LP #2078003). - bind9-libs: Hard-code libuv1t64 instead of libuv1 - no longer needed. -- Lena Voytek <[email protected]> Thu, 24 Jul 2025 13:50:58 -0400 bind9 (1:9.20.11-1) unstable; urgency=high * New upstream version 9.20.11 + [CVE2025-40777]: Fix a possible assertion failure when stale-answer-client-timeout is set to 0. -- Ondřej Surý <[email protected]> Wed, 16 Jul 2025 17:08:46 +0200 bind9 (1:9.20.10-1ubuntu1) questing; urgency=medium * Merge with Debian unstable. Remaining changes: - Don't build dnstap as it depends on universe packages: + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and protobuf-c-compiler (universe packages) + d/dnsutils.install: don't install dnstap + d/rules: don't build dnstap nor install dnstap.proto - Add back apport: + d/bind9.apport: add back old bind9 apport hook, but without calling attach_conffiles() since that is already done by apport itself, with confirmation from the user. + d/control, d/rules: build-depends on dh-apport and use it - d/NEWS: mention relevant packaging changes - d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650) - d/t/control: Disable dyndb-ldap test as bind-dyndb-ldap has been removed from Ubuntu for now (LP #2078003). - bind9-libs: Hard-code libuv1t64 instead of libuv1. -- Lena Voytek <[email protected]> Mon, 23 Jun 2025 09:41:50 -0400 bind9 (1:9.20.10-1) unstable; urgency=medium * New upstream version 9.20.10 -- Ondřej Surý <[email protected]> Fri, 20 Jun 2025 06:25:07 +0200 bind9 (1:9.20.9-2ubuntu1) questing; urgency=medium * Merge with Debian unstable (LP: #2110436). Remaining changes: - Don't build dnstap as it depends on universe packages: + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and protobuf-c-compiler (universe packages) + d/dnsutils.install: don't install dnstap + d/rules: don't build dnstap nor install dnstap.proto - Add back apport: + d/bind9.apport: add back old bind9 apport hook, but without calling attach_conffiles() since that is already done by apport itself, with confirmation from the user. + d/control, d/rules: build-depends on dh-apport and use it - d/NEWS: mention relevant packaging changes - d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650) - d/t/control: Disable dyndb-ldap test as bind-dyndb-ldap has been removed from Ubuntu for now (LP #2078003). - bind9-libs: Hard-code libuv1t64 instead of libuv1. * Drop Changes: - Improve dep-8 test suite (LP #2003584): + d/t/zonetest: Add dep8 test for checking the domain zone creation process + d/t/control: Add new test outline - d/po/de.po: Fix German UTF-8 encoding - d/control: Remove lsb-base dependency as it is no longer needed + See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019851 - d/copyright: Fix lintian warnings [Added to Debian] - d/p/CVE-2025-40775.patch [Fixed in 9.20.9] -- Lena Voytek <[email protected]> Thu, 05 Jun 2025 13:34:24 -0400 bind9 (1:9.20.9-2) unstable; urgency=low * Fix the default branch in the Vcs-Git field (Closes: #1106677) -- Ondřej Surý <[email protected]> Wed, 28 May 2025 13:39:20 +0200 bind9 (1:9.20.9-1) unstable; urgency=high * New upstream version 9.20.9 + [CVE-2025-40775] Prevent assertion when processing TSIG algorithm. -- Ondřej Surý <[email protected]> Wed, 21 May 2025 13:44:48 +0200 bind9 (1:9.20.8-6) unstable; urgency=medium * Adjust the autopkg zonetest -- Ondřej Surý <[email protected]> Fri, 18 Apr 2025 18:40:30 +0200 bind9 (1:9.20.8-5) unstable; urgency=medium [ Remus-Gabriel Chelu ] * [INTL:ro] Romanian debconf templates translation of bind9 [ Ondřej Surý ] * Fix lintian mismatched-override * Use pkgconf instead of pkg-config * Remove superfluous-file-pattern(s) from d/copyright * Remove full path to named-checkconf in d/bind9.postinst -- Ondřej Surý <[email protected]> Thu, 17 Apr 2025 21:50:52 +0200 bind9 (1:9.20.8-4) unstable; urgency=medium [ Lena Voytek ] * Add zonetest DEP-8 test -- Ondřej Surý <[email protected]> Thu, 17 Apr 2025 21:21:42 +0200 bind9 (1:9.20.8-3) unstable; urgency=medium [ Lena Voytek ] * Fix German UTF-8 encoding * Clean up debian/copyright file * Remove lsb-base runtime dependency as it is no longer needed [ Santiago Ruano Rincón ] * Add debian/salsa-ci.yml * Make d/tests/validation less flaky. [ Carles Pina i Estany ] * Added po-debconf Catalan translation [ Mitchell Dzurick ] * d/control: Suggest bind9-doc over bind-doc for the bind9 package [ Debian Janitor ] * Apply multi-arch hints. + bind9-doc: Add Multi-Arch: foreign. -- Ondřej Surý <[email protected]> Thu, 17 Apr 2025 21:07:33 +0200 bind9 (1:9.20.8-2) unstable; urgency=medium * Validate configuration file before service restart (Closes: #995310, #1054314) -- Ondřej Surý <[email protected]> Thu, 17 Apr 2025 18:49:10 +0200 bind9 (1:9.20.8-1) unstable; urgency=medium * New upstream version 9.20.8 -- Ondřej Surý <[email protected]> Wed, 16 Apr 2025 15:05:13 +0200 bind9 (1:9.20.7-1) unstable; urgency=medium * New upstream version 9.20.7 -- Ondřej Surý <[email protected]> Thu, 13 Mar 2025 11:37:20 +0100 bind9 (1:9.20.6-1) unstable; urgency=medium * Add Provides: bind9utils and Provides: dnsutils to the respective packages * New upstream version 9.20.6 -- Ondřej Surý <[email protected]> Wed, 19 Feb 2025 16:00:19 +0100 bind9 (1:9.20.5-1) unstable; urgency=medium * New upstream version 9.20.5 (Closes: #1094735) - CVE-2024-12705: DNS-over-HTTPS flooding fixes - CVE-2024-11187: Limit additional section processing for large RDATA sets * Drop libltdl-dev from Build-Depends, libuv wrappers are used for dlopen and friends. -- Ondřej Surý <[email protected]> Mon, 27 Jan 2025 12:21:49 +0100 bind9 (1:9.20.4-4) unstable; urgency=medium * Revert "Temporarily use rbtdb as a zone database to prevent assertion failure" * Add pre-release patch for the NSEC3 encloser assertion failure -- Ondřej Surý <[email protected]> Tue, 21 Jan 2025 16:16:07 +0100 bind9 (1:9.20.4-3ubuntu3) questing; urgency=medium * No-change rebuild for libxml2 soname change. -- Matthias Klose <[email protected]> Mon, 26 May 2025 14:23:49 +0200 bind9 (1:9.20.4-3ubuntu2) questing; urgency=medium * SECURITY UPDATE: message with invalid TSIG causes an assertion failure - debian/patches/CVE-2025-40775.patch: properly validate messages in lib/dns/include/dns/message.h, lib/dns/include/dns/tsig.h, lib/dns/message.c, lib/dns/tsig.c, tests/dns/tsig_test.c. - CVE-2025-40775 -- Marc Deslauriers <[email protected]> Tue, 20 May 2025 07:25:11 -0400 bind9 (1:9.20.4-3ubuntu1) plucky; urgency=medium * Merge with Debian unstable (LP: #2085207). Remaining changes: - Don't build dnstap as it depends on universe packages: + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and protobuf-c-compiler (universe packages) + d/dnsutils.install: don't install dnstap + d/rules: don't build dnstap nor install dnstap.proto - Add back apport: + d/bind9.apport: add back old bind9 apport hook, but without calling attach_conffiles() since that is already done by apport itself, with confirmation from the user. + d/control, d/rules: build-depends on dh-apport and use it - d/NEWS: mention relevant packaging changes - Improve dep-8 test suite (LP #2003584): + d/t/zonetest: Add dep8 test for checking the domain zone creation process + d/t/control: Add new test outline - d/po/de.po: Fix German UTF-8 encoding - d/copyright: Fix lintian warnings + Remove the entry for lib/isc/hp.c lib/isc/include/isc/hp.h as they were deleted in 9.18.2 + Remove the entry for lib/isc/include/pkcs11/pkcs11.h as it is no longer bundled as of 9.17.19 + Update the location of random_test.c and add info about its public domain section + Add wildcards to folders as needed + Note that m4/ uses the FSFAP license - d/control: Remove lsb-base dependency as it is no longer needed + See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019851 - d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650), but disable it as bind-dyndb-ldap has been removed from Ubuntu for now (LP #2078003). - bind9-libs: Hard-code libuv1t64 instead of libuv1. * Drop Changes: - d/p/stop-using-malloc_usable_size.patch: Fixed upstream - https://gitlab.isc.org/isc-projects/bind9/-/issues/4880 - libjemalloc-dev dependency removal: Re-added as jemalloc is now in main (LP 2088056). -- Lena Voytek <[email protected]> Thu, 09 Jan 2025 15:52:20 -0500 bind9 (1:9.20.4-3) unstable; urgency=high * Temporarily use rbtdb as a zone database as workaround for an upstream bug. -- Ondřej Surý <[email protected]> Thu, 19 Dec 2024 05:56:30 +0100 bind9 (1:9.20.4-2) unstable; urgency=medium * Add upstream patch for the new GLUE cache implementation -- Ondřej Surý <[email protected]> Sun, 15 Dec 2024 08:02:25 +0100 bind9 (1:9.20.4-1) unstable; urgency=medium * New upstream version 9.20.4 -- Ondřej Surý <[email protected]> Wed, 11 Dec 2024 17:35:53 +0100 bind9 (1:9.20.3-1) unstable; urgency=medium * New upstream version 9.20.3 -- Ondřej Surý <[email protected]> Thu, 10 Oct 2024 10:37:54 +0200 bind9 (1:9.20.2-1) unstable; urgency=medium * New upstream version 9.20.2 -- Ondřej Surý <[email protected]> Fri, 20 Sep 2024 14:35:10 +0200 ** Affects: bind9 (Ubuntu) Importance: Wishlist Status: New ** Tags: needs-merge upgrade-software-version ** Changed in: bind9 (Ubuntu) Importance: Undecided => Wishlist ** Changed in: bind9 (Ubuntu) Milestone: None => ubuntu-27.01 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171107 Title: Merge bind9 1:9.21.26-1 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/2171107/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
