Security fixes:
- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator.
(CVE-2025-40780)
New Features:
- Support for parsing HHIT and BRID records has been added.
Removed Features:
- Deprecate the "tkey-domain" statement.
- Deprecate the "tkey-gssapi-credential" statement.
Bug Fixes:
- Prevent spurious SERVFAILs for certain 0-TTL resource records.
- Missing DNSSEC information when CD bit is set in query.
https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/notes.html#notes-for-bind-9-18-41
New Features:
- Support for parsing the DSYNC record has been added.
Feature Changes:
- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.
Bug Fixes:
- Clean enough memory when adding new ADB names/entries under memory pressure.
- Rescan the interfaces again when reconfiguring the server.
https://downloads.isc.org/isc/bind9/9.18.39/doc/arm/html/notes.html#notes-for-bind-9-18-39
Security Fixes:
- Fix an issue when some specific queries could remain unanswered with serve-stale enabled.
New Features:
- Add support for the CO flag to dig.
Bug fixes:
- Correct the default interface-interval from 60s to 60m.
- Fix a purge-keys bug when using multiple views of a zone.
Security Fixes:
- DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
- Limit additional section processing for large RDATA sets. (CVE-2024-11187)
New Features:
- Add a new option to configure the maximum number of outgoing queries per client request.
Bug Fixes:
- Fix nsupdate hang when processing a large update.
- Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006]
- Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
- Fix improper handling of unknown directives in resolv.conf.
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33
(cherry picked from commit c72c74cce0)
- Print the full path of the working directory in startup log messages.
- Follow the number of CPUs set by taskset/cpuset.
- Verification of the privacy of an EDDSA key was broken.
- Fix algorithm rollover bug when there are two keys with the same keytag.
https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-30
Update to 9.18.29
Feature Changes:
- Tighten max-recursion-queries and add max-query-restarts configuration statement.
- Raise the log level of priming failures.
- Add a compatibility shim for older libuv versions (< 1.19.0)
Bug Fixes:
Return SERVFAIL for a too long CNAME chain.
- Reconfigure catz member zones during named reconfiguration.
- Update key lifetime and metadata after dnssec-policy reconfiguration.
- Fix generation of 6to4-self name expansion from IPv4 address.
- dig +yaml was producing unexpected and/or invalid YAML. output. [GL #4796] [GL !9214]
- SVBC ALPN text parsing failed to reject zero-length ALPN. [GL #4775] [GL !9210]
- Fix false QNAME minimisation error being reported.
- Fix dig +timeout argument when using +https.
https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-29
https://downloads.isc.org/isc/bind9/9.18.21/doc/arm/html/notes.html#notes-for-bind-9-18-21
Removed Features
- Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead. [GL #4421]
- The resolver-nonbackoff-tries and resolver-retry-interval statements have been deprecated. Using them now causes a warning to be logged. [GL #4405]
Resolves CVE-2021-25215 and CVE-2021-25214.
Removes disable-isc-spnego flag, because custom isc spnego code were
removed with also this flag. It is default (and the only) option now.
Reworked custom redhat version. Complete version is now part of library
names. Libraries are not recommended for any third party application.
They are still required for bind-dyndb-ldap only.
Version of named changed, only suffix -RH is appended to upstream
version. Therefore dig would not contain version
9.6.11-RedHat-9.6.11-1.fc34, but only 9.6.13-RH. Version of fedora build
have to be obtained from rpm -q bind.
Version is now part of library names, bind-libs-lite was merged to
bind-libs. bind-dyndb-ldap needs whole bind, no point to offer smaller
library set just for its dependencies.
Updated also named(8) manual page to match current state of SELinux.
