Remove original bind.keys and replace it with sourced file. Ensure it is
converted into header by deleting original header before the build.
Resolves: RHEL-131887
When resolving a domain with many nameservers that share overlapping IP addresses (e.g., 10 NS records all pointing at the same set of addresses), BIND could previously waste time querying duplicate addresses and build up excessively large server lists. Deduplicate addresses in the resolver's server list so that each unique IP is only queried once per resolution attempt, regardless of how many NS records point to it and cap the number of addresses stored per nameserver name to 6 (combined A and AAAA), preventing memory and CPU overhead from domains with unusually large NS/glue sets.
Closesisc-projects/bind9#5641
RH:
No tests are backported, because python tests in this version does not have have
a good enough support for it.
Resolves: RHEL-189746
CVE: CVE-2026-3592
A bug during bad server handling could cause the resolver to enter an infinite loop, continuously sending queries to an upstream server with no exit condition, until the resolver query timeout was hit. This has been fixed.
ISC would like to thank Billy Baraja (BielraX) for bringing this issue to our attention.
Closesisc-projects/bind9#5804
Resolves: RHEL-189754
CVE: CVE-2026-5950
Backport upstream fix for CVE-2026-10723 which validates that
NSEC3 record signers match the owning zone. This prevents a
child zone from impersonating its parent and forging NXDOMAIN
responses for sibling domains. The patch adds signer
validation in lib/dns/dnssec.c and updates the NSEC3 error
description string in lib/isc/result.c.
CVE: CVE-2026-10723
Upstream patches:
- c9cb6a5e24.patch
Resolves: RHEL-213500
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add patch to reject out-of-zone NSEC next owner names during
DNSSEC verification. When verifying DNSSEC records, the patch
ensures that the next owner name of an NSEC record is a
subdomain of the signer field, following RFC 4034 section
4.1.1. The RETERR() macro calls in the new code were replaced
with inline error handling to match the dns_dnssec_verify
function's existing conventions.
CVE: CVE-2026-13321
Upstream patches:
- 058023c66f.patch
- f751e19a30.patch
Resolves: RHEL-213312
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 231b1ca3ed ("Make the dns_slabheaders
in the cache reference counted") to bind 9.18.29 to fix
CVE-2026-11622. The patch adds reference counting to
dns_slabheaders so stale headers can be reclaimed independently
of their enclosing node, preventing cache exhaustion.
The new patch (Patch232: bind-9.18-CVE-2026-11622.patch)
modifies lib/dns/rbtdb.c, lib/dns/include/dns/rdataslab.h,
and bin/tests/system/reclimit/tests.sh.
CVE: CVE-2026-11622
Upstream patches:
- 231b1ca3ed.patch
Resolves: RHEL-213388
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-11721 to bind9.18-9.18.29. Invalid
signed wildcard records (RRSIG with fewer labels than the
signer name requires) were being accepted, allowing cache
poisoning via forged wildcard owner names.
Two upstream commits were cherry-picked and combined into
Patch232 (bind-9.18-CVE-2026-11721.patch):
- 15089066b1: core validation fix in lib/dns/dnssec.c and
lib/dns/rdata/generic/rrsig_46.c
- 1a4986e253: dnssec-signzone fix in
bin/dnssec/dnssec-signzone.c
CVE: CVE-2026-11721
Upstream patches:
- 15089066b1.patch
- 1a4986e253.patch
Resolves: RHEL-213419
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-11331 from upstream commit dc328a199f.
The patch modifies query_rpzcname() in lib/ns/query.c to ensure
that when a wildcard expansion results in a name-too-long error,
the YXDOMAIN response code is set and the function properly
returns, rather than falling through to create a self-referential
CNAME.
CVE: CVE-2026-11331
Upstream patches:
- dc328a199f.patch
Resolves: RHEL-213770
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add patch for CVE-2026-13204 which fixes a denial of service
vulnerability where dns_rdataset_addnoqname() could accept
unsigned NSEC/NSEC3 records, leading to assertion failures.
The upstream fix replaces RUNTIME_CHECK assertions with
graceful error handling in rbtdb.c, resolver.c, and query.c,
and hardens rdatalist.c to only accept signed records. The
patch includes an additional fix for query.c where the
upstream CHECK() macro was replaced with explicit inline
error handling to use the correct error label.
CVE: CVE-2026-13204
Upstream patches:
- 48f5aa5fb3.patch
Resolves: RHEL-213494
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Recursion, dynamic updates (UPDATE), and zone change notifications
(NOTIFY) are now disabled for views with a class other than IN
(such as CHAOS or HESIOD); authoritative service for non-IN zones
(e.g. version.bind in class CHAOS) continues to work as before.
Servers configured with recursion yes in a non-IN view will log a
warning at startup, and named-checkconf flags the same condition.
UPDATE and NOTIFY messages that specify the meta-classes ANY or NONE
in the question section are now rejected with FORMERR.
This addresses a set of closely related security issues collectively
identified as CVE-2026-5946. ISC would like to thank Mcsky23 for
bringing these issues to our attention.
Resolves-Vulnerability: CVE-2026-5946
Resolves: RHEL-177754
Fixed a memory leak where each GSS-API TKEY negotiation leaked a security context inside the GSS library. An unauthenticated attacker could exhaust server memory by sending repeated TKEY queries to a server with tkey-gssapi-keytab configured. The leaked memory was allocated by the GSS library, bypassing BIND's memory accounting.
Multi-round GSS-API negotiation (GSS_S_CONTINUE_NEEDED) is now rejected, as BIND never supported it correctly and Kerberos/SPNEGO completes in a single round.
Also implemented missing RFC 3645 requirement: the client now verifies that mutual authentication and integrity flags are granted by the GSS-API mechanism (Section 3.1.1).
Resolves-Vulnerability: CVE-2026-3039
Resolves: RHEL-177772
DNSSEC-signed zones may contain high iteration-count NSEC3 records,
which prove that certain delegations are insecure. Previously, a
validating resolver encountering such a delegation processed these
iterations up to the number given, which could be a maximum of 65,535.
This has been addressed by introducing a processing limit, set at 150.
Now, if such an NSEC3 record is encountered, the delegation will be
treated as insecure.
ISC would like to thank Samy Medjahed/Ap4sh for bringing this
vulnerability to our attention.
Closesisc-projects/bind9#5708
Resolves-Vulnerability: CVE-2026-1519
One of libdir directories was forgotten. It is the directory containing
the actual plugin, might cause issues if filter-aaaa.so plugin is used.
Resolves: RHEL-132054
Drop original user creating in favor of sysusers file definition.
(cherry picked from commit 071ec07d27989a8d548834292fa46ca2312b4862)
(cherry picked from commit efb20ad8e740aafb410c0609fe94551135f2054b)
Resolves: RHEL-132054
(cherry picked from commit 4f18fb958fc3108bdca4c8192f7872db02c49673)
Imagemode might have separate /var partition not properly initialized by
package installation. Add creation of compat files into tmpfiles.d
definition.
Make copies of those files from /var/named to /usr/shared/named, so we
even have some place to symlink them from. Originally it had only copy
in sample documentation, which may not be installed.
These source file should be read-only from named and not modified
anyway. Copy them to /usr/share/named as read-only, always present
sources. Make symlinks in /var/named to point to them only when files
are missing.
To maximize backward compatibility, make copies and avoid replacing
those files with symlinks.
Resolves: RHEL-122168
Many variants are never built anymore. Clean actions to just those still
shipped. But do not trigger named reload when named.run file is empty.
That is common on freeipa installation, where configuration changes
logging to put it elsewhere. named reload is disruptive because how
bind-dyndb-ldap behaves during reloads. Avoid unnecessary reloads with
visible service disruption.
Keep named-pkcs11 reload variant.
Resolves: RHEL-113968
resume_qmin did not handle special case of recursing query hit
unexpected DNS_R_CNAME result. Change result to SERVFAIL in case
of a zone loaded after the recursion started. That prevents crashing
later in query_setorder, where there is uninitialized foundname compared
with absolute order names.
https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
Resolves: RHEL-96648
Fix DNS-over-HTTP(S) implementation issues that arise under heavy
query load. Optimize resource usage for :iscman:`named` instances
that accept queries over DNS-over-HTTP(S).
Previously, :iscman:`named` would process all incoming HTTP/2 data
at once, which could overwhelm the server, especially when dealing
with clients that send requests but don't wait for responses. That
has been fixed. Now, :iscman:`named` handles HTTP/2 data in smaller
chunks and throttles reading until the remote side reads the
response data. It also throttles clients that send too many requests
at once.
Additionally, :iscman:`named` now carefully processes data sent by
some clients, which can be considered "flooding." It logs these
clients and drops connections from them.
:gl:`#4795`
In some cases, :iscman:`named` could leave DNS-over-HTTP(S)
connections in the `CLOSE_WAIT` state indefinitely. That also has
been fixed. ISC would like to thank JF Billaud for thoroughly
investigating the issue and verifying the fix.
:gl:`#5083`
Vulnerability: CVE-2024-12705
Resolves: RHEL-76868
When answering queries, don't add data to the additional section if the answer has more
than 13 names in the RDATA. This limits the number of lookups into the database(s) during
a single client query, reducing query processing load.
Vulnerability: CVE-2024-11187
Resolves: RHEL-76889
component is used in tests/bind tests to choose correct requirements for
otherwise shared tests. Try to put context propagated from original
package to those tests.
Do not use public repo import, but (re)define it manually to keep
context propagated.
Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
Resolves: RHEL-14898
