Security Fixes:
- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)
New Features:
- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.
Bug Fixes:
- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.
Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20
Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
Security Fixes:
- Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)
New Features:
- Add support for Extended DNS Error 9 (Missing DNSKEY).
- Add support for Extended DNS Error 13 (Cached Error).
- Add support for Generalized DNS Notifications.
Features Changes:
- Add more information to the rndc recursing output about fetches.
- Enforce bounds of multiple configuration options.
Bug Fixes:
- Fix inbound IXFR performance regression.
- Make DNSSEC key rollovers more robust.
- Fix a catalog zone issue, where member zones could fail to load.
- Fix slow speed when signing a large delegation zone with NSEC3 opt-out.
- Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.
- Fix a possible catalog zone issue during reconfiguration.
- Fix the charts in the statistics channel.
https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17
Security Fixes:
- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780)
New Features:
- Add dnssec-policy keys configuration check to named-checkconf.
- Add support for synthetic records.
- Support for zone-specific plugins.
- Support for additional tokens in the zone file name template.
Removed Features:
- Remove randomized RRset ordering.
and bug fixes
https://downloads.isc.org/isc/bind9/9.21.14/doc/arm/html/notes.html#notes-for-bind-9-21-14
New Features:
- Support for parsing DSYNC records has been added.
Feature changes:
- Reword the shut down hung fetch while resolving message.
- Plugin extension in plugin path is now optional.
- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.
And multiple bug fixes.
https://downloads.isc.org/isc/bind9/9.21.11/doc/arm/html/notes.html#notes-for-bind-9-21-11
CHANGES did not contain anything useful recently. Skip bigger
changelog-history in normal package. Include also history in doc
package.
Include original release notes in rst format inside doc package. That
format is nice to use from terminal interface, especially when syntax is
highlighted by vim for example.
New Features:
- Add separate query counters for new protocols. [GL #598]
- Implement RFC 9567: EDNS Report-Channel option.[GL #3659]
- Add detailed debugging of update-policy rule matching. [GL #4751]
- Enable runtime selection of FIPS mode in dig and delv. [GL #5046]
Removed Features:
- Move contributed DLZ modules into a separate repository.
DLZ modules should not be used except in testing. [GL #4865]
- Remove RBTDB implementation. [GL #5027]
Features Changes:
- dnssec-ksr now supports KSK rollovers. [GL #4697] [GL #4705]
- Add none parameter to query-source and query-source-v6 to disable IPv4
or IPv6 upstream queries but allow listening to queries from clients on
IPv4 or IPv6.
- Print RFC 7314: EXPIRE option in transfer summary. [GL #5013]
- Add missing EDNS option mnemonics to dig.
- Add new logging module for crypto errors in libisc.
- Emit more helpful log messages for exceeding max-records-per-type.
- Harden key management when key files have become unavailable.
- Reduce memory footprint by optimizing commonly-used data structures. [GL #5022]
And multiple bug fixes.
https://downloads.isc.org/isc/bind9/9.21.3/doc/arm/html/notes.html#notes-for-bind-9-21-3
Avoids terminating with similar failre:
[ RUN ] isc_rwlock_benchmark
PID 38869 exceeded run time limit, sending SIGABRT
FAIL rwlock_test (exit status: 124)
named contains high number of assertions checking expected state of the
daemon. That is part of defensive code style to prevent many attacks.
The most common failure is failing some assertion check in rare
circumstances. Even when this should not happen, try keeping the service
running. If such failed assertion produces coredump just from time to
time, avoid failing hard the whole service. coredumpctl will keep track
of all crashes anyway.
https://downloads.isc.org/isc/bind9/9.19.21/RELEASE-NOTES-bind-9.19.21.html
Security Fixes
- Validating DNS messages containing a lot of DNSSEC signatures could cause
excessive CPU load, leading to a denial-of-service condition. This has
been fixed. (CVE-2023-50387)
ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and
Michael Waidner from the German National Research Center for Applied
Cybersecurity ATHENE for bringing this vulnerability to our attention. [GL #4424]
- Parsing DNS messages with many different names could cause excessive CPU load.
This has been fixed. (CVE-2023-4408)
ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr
from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt
from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234]
- Specific queries could cause named to crash with an assertion failure when
nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281]
- A bad interaction between DNS64 and serve-stale could cause named to crash with an
assertion failure, when both of these features were enabled. This has been fixed.
(CVE-2023-5679) [GL #4334]
Resolves: CVE-2023-50387 CVE-2023-4408 CVE-2023-5517 CVE-2023-5679
