Devel libs detection from bind-dyndb-ldap needs working
_libdir/libdns.so. Provide extra symlink to that. But requires
additional change on bind-dyndb-ldap change to follow those links.
Found out that multiple programs require fixed name and cannot contain
suffixes. This will fix those programs to run as designed and switch
versions. It affects:
- tsig-keygen
- ddns-confgen
- named-checkzone
- named-compilezone
This should make those tools to decide only based or starting part of
the program. Upstream supported suffix .exe, but we need support of
different suffixes. This change should work for both.
[9.18] [CVE-2026-13321] sec: usr: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field
A malicious zone with out-of-zone NSEC next owner names can cause a DNSSEC validating resolver to cache such record and, if `synth-from-dnssec` is enabled, to generate negative answers for any zone that is covered by the range.
ISC would like to thank Qifan Zhang of Palo Alto Networks for reporting the issue.
Closesisc-projects/bind9#5873
[9.18] [CVE-2026-13204] fix: usr: Prevent crash from malformed NSEC/NSEC3 response
An assertion could be triggered by an improperly signed NOQNAME proof. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.
Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5985
[9.18] [CVE-2026-10723] sec: usr: Correct verification of NSEC3 signer name
BIND 9 accepted child-zone NSEC3 records where the first label equals the hash of the parent zone as valid parent-zone closest encloser proofs. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.
Closesisc-projects/bind9#5874
[9.18] [CVE-2026-11721] sec: usr: Invalid signed wildcard records were being accepted
Signed wildcard responses in which the Labels field in the `RRSIG` record was less than the number of labels in the Signer Name field were being incorrectly accepted. This in turn broke `synth-from-dnssec`, which depends on such records being correctly validated. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention.
Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5871
[9.18] [CVE-2026-11622] sec: usr: Prevent cache exhaustion under sustained attack
The cache memory can become exhausted with expired entries whose memory
is not released due to a sustained attack on the same DNS name that
prevents the cleanup. This has been fixed.
Closes: https://gitlab.isc.org/isc-projects/bind9/-/work_items/4760
[9.18] [CVE-2026-12617] sec: usr: Do no assert for some specifics CNAME and DNAME queries
A bug in the resolver's handling of certain cached DNAME and CNAME responses could cause named to trigger an assertion failure and exit. An attacker controlling a domain name and the authoritative DNS server it is hosted on could exploit this behavior to cause a denial-of-service. This vulnerability has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention.
Closes: isc-projects/bind9#5946
[9.18] fix: test: Stabilize the cname_dname_negcache test
The test proved unstable due to timing-related race condition, which could produce both false positive and false negative results. Use a more reliable mechanism to reproduce the issue.
Human-effort-level: low
[9.18] [CVE-2026-10822] sec: usr: Fix dns_name_fromwire to record boundaries
Previously, `dns_name_fromwire()` did not honor the record boundary when reading names from the wire, allowing malformed records to be accepted when they should not have been. This has been fixed.
Closes: https://gitlab.isc.org/isc-projects/bind9/-/issues/6004
[9.18] [CVE-2026-11331] sec: usr: Fix handling of rpz CNAME expansion that returns name too long
Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self referential CNAME and the original address record were returned, allowing the policy to be bypassed. In branches up to 9.20, this also left query processing in an inconsistent state which could trigger an assertion failure. We now return a YXDOMAIN response, without the address.
ISC would like to thank Laith Mash'al (0xmshal) for bringing this issue to our attention.
Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5856
The same trick that worked fine for normal files does not work on ghost
file. %ghost flag seems to require only single file after it. Shell is
not expanded, but used in the name.
In this case it should help with protobuf-c-devel dependency, because it
is now provided by protobuf3-c-devel. But pkgconfig is used by bind
anyway and it should make it more safe.
Break requires onto separate lines, if they are provided by different
packages. Stylistic change only.
Provide compatibility symlink until it is replaced. Freeipa calls the
original place for script used to generate /etc/rndc.key. Preferred
variant should be "systemctl restart named-setup-rndc.service" command.
Until that is used everywhere, provide compatibility fix.
Multiple variants are not built in single build for a long time. Using
different builddir causes a lot of issues in test suite. We do not need
nor want subdirectory anymore. Use source directory for building and
test running.
Might need additional adjusts in tests repository on running test suite.
Support basic systemd unit handling
Fix double inclusion of bind9 include subdirectory
Fix bind-dnssec-utils ghost files
Make permissions match target binaries too.
Do not use alternatives for named-checkzone and named-compilezone
Use alternatives, prefix name with %{upname}-
Add also usage of --initscript %{name}. Not use if named service name
should not be used there instead. Match also remove names.
Define reusable variables with tool names
Use it to define common lists, reuse them multiple times.
Add named-{checkzone,compilezone}. Fix utils man8 typo.
Handle mans and units too.
Move creation of systemd units into build phase. Replace not only %name,
also program_suffix.
Change services to use template for systemd unit files
To execute correctly systemd services, make them templates fixed at the
build time. Still conflicts with potential alternatives.
Solve also filter plugins to have suffix also.
Only bind-dyndb-ldap uses devel package. Move includes and libraries to
contain major version. That should allow to install both bind9.18-devel
and bind9.20-devel at the same time. Needed to build multiple
bind-dyndb-ldap plugin versions for different variants.
Adjusted to bind 9.18 main component.
Removed Features:
- Remove ineffective TCP fallback after repeated UDP timeouts.
Feature Changes:
- Fall back to TCP on receipt of a UDP response with a mismatched query ID.
Bug Fixes:
- Fix DNS64 owner case after DNAME restart.
- Clear REDIRECT flag when it isn't needed.
This should be final release of BIND 9.18 line. That version is now
marked EOL.
Source: https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/notes.html#notes-for-bind-9-18-50
Security Fixes:
- Limit resolver server list size. (CVE-2026-3592)
- Fix GSS-API resource leak. (CVE-2026-3039)
- Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946)
- Avoid unbounded recursion loop. (CVE-2026-5950)
- Fix outgoing zone transfers' quota issue.
Feature Changes:
- Fix CPU spikes and slow queries when cache approaches memory limit.
Bug Fixes:
- Fix named crash when processing SIG records in dynamic updates.
- Fix rndc modzone behavior for a zone in named.conf.
- Fix zone verification of NSEC3 signed zones.
- Prevent a crash when using both dns64 and filter-aaaa.
- Fixed an assertion failure when processing catalog zones.
- Prevent malicious DNSSEC zones from exhausting validator CPU.
- Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits.
- Prevent crafted queries from degrading RRL performance.
- Fix a bug in allow-query/allow-transfer catalog zone custom properties.
- Fix a memory leak issue in catalog zones.
- Fix suppressed missing-glue check in named-checkzone.
- Reject record sets too large to serve in DNS.
Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for-bind-9-18-49
One of libdir directories was forgotten. It is the directory containing
the actual plugin, might cause issues if filter-aaaa.so plugin is used.
Related: RHEL-132054
Security fixes:
- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator.
(CVE-2025-40780)
New Features:
- Support for parsing HHIT and BRID records has been added.
Removed Features:
- Deprecate the "tkey-domain" statement.
- Deprecate the "tkey-gssapi-credential" statement.
Bug Fixes:
- Prevent spurious SERVFAILs for certain 0-TTL resource records.
- Missing DNSSEC information when CD bit is set in query.
https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/notes.html#notes-for-bind-9-18-41
Make the reference to primary source in absolute path, rather than
relative to working directory.
Potentially could start using different files than it used before.
Dot not cherry-pick this into stable branches. Could be considered
breaking change, keep it just in rawhide only.
