UbuntuUpdates.org

Package "bind9-dnsutils"

Name: bind9-dnsutils

Description:

Clients provided with BIND 9
Latest version: 1:9.18.39-0ubuntu0.22.04.7
Release: jammy (22.04)
Level: security
Repository: main
Head package: bind9
Homepage: https://www.isc.org/downloads/bind/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "bind9-dnsutils"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "bind9-dnsutils" in Jammy

Repository Area Version
base main 1:9.18.1-1ubuntu1
updates main 1:9.18.39-0ubuntu0.22.04.6

Changelog

Version: 1:9.18.39-0ubuntu0.22.04.7 2026-10-14 14:07:48 UTC

bind9 (1:9.18.39-0ubuntu0.22.04.7) jammy-security; urgency=medium

  * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME
    records
    - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in
      lib/dns/message.c.
    - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated
      singleton records in a message in tests/dns/Makefile.am,
      tests/dns/message_test.c.
    - CVE-2026-75029
  * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers
    - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the
      DNS64 filter64 path in lib/ns/query.c.
    - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path
      against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,
      bin/tests/system/dns64/ns2/named.conf.in, bin/tests/system/dns64/tests.sh.
    - CVE-2026-19666
  * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC
    proofs
    - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser
      proof caching in lib/dns/dnsrps.c, lib/dns/include/dns/rdataset.h,
      lib/dns/keytable.c, lib/dns/ncache.c, lib/dns/rbtdb.c,
      lib/dns/rdatalist.c, lib/dns/rdatalist_p.h, lib/dns/rdataset.c,
      lib/dns/resolver.c, lib/dns/sdb.c, lib/dns/sdlz.c, lib/ns/query.c.
    - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders
      alive in lib/dns/rbtdb.c.
    - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader
      lifetime in tests/dns/rbtdb_test.c.
    - CVE-2026-19662
  * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof
    - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from
      the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.
    - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC
      wildcard proofs in bin/tests/system/Makefile.am,
      bin/tests/system/conf.sh.common,
      bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,
      bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys
      tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.
    - CVE-2026-19941
  * SECURITY UPDATE: Out-of-zone records served as authoritative
    - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex
      are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,
      bin/tests/system/outofzone_zonecut/ns1/example.db,
      bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,
      bin/tests/system/outofzone_zonecut/ns1/root.db,
      bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,
      bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,
      bin/tests/system/outofzone_zonecut/ns2/nszone.db,
      bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,
      bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,
      bin/tests/system/outofzone_zonecut/ns3/nszone.db,
      bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.
    - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin
      in RBT zone database lookups in lib/dns/rbtdb.c, tests/dns/rbtdb_test.c.
    - CVE-2026-78301
  * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records
    - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS
      AliasMode additional-data errors in
      bin/tests/system/additional/ns1/https.db,
      bin/tests/system/additional/ns1/named1.conf.in,
      bin/tests/system/additional/ns1/named2.conf.in,
      bin/tests/system/additional/ns1/named3.conf.in,
      bin/tests/system/additional/ns1/named4.conf.in,
      bin/tests/system/additional/ns2/root.db,
      bin/tests/system/additional/ns3/named.conf.in,
      bin/tests/system/additional/tests_https_alias.py.
    - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB
      additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.
    - CVE-2026-81563
  * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone
    - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the
      insecure-referral proof in lib/dns/validator.c.
    - CVE-2026-77119
  * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3
    proofs
    - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection
      consistent in lib/dns/include/dns/rdataset.h,
      lib/dns/include/dns/validator.h, lib/dns/rdatalist.c,
      lib/dns/rdatalist_p.h, lib/dns/rdataset.c, lib/dns/resolver.c,
      lib/dns/validator.c, tests/dns/rbtdb_test.c.
    - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the
      rdataset unit test in tests/dns/rdataset_test.c.
    - debian/patches/CVE-2026-80274-3.patch: Make the findnoqname mismatch
      system test reach the resolver in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py, bin/tests/system
      /dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-80274
  * SECURITY UPDATE: Zone transfer data used before TSIG verification
    - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in
      lib/dns/xfrin.c.
    - CVE-2026-19033
  * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records
    - debian/patches/CVE-2026-81736-1.patch: Bound the total additional
      processing for a single query in lib/ns/client.c,
      lib/ns/include/ns/client.h, lib/ns/query.c.
    - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS
      AliasMode additional processing in
      bin/tests/system/additional/ns1/https.db,
      bin/tests/system/additional/tests_https_alias.py,
      bin/tests/system/svcb_alias/ns1/named.conf.j2,
      bin/tests/system/svcb_alias/ns1/root.hint,
      bin/tests/system/svcb_alias/ns2/named.conf.j2,
      bin/tests/system/svcb_alias/ns2/root.db,
      bin/tests/system/svcb_alias/setup.sh,
      bin/tests/system/svcb_alias/tests_svcb_
Source diff to previous version
CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is th
CVE-2026-19666 On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named`
CVE-2026-19662 An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-
CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an u
CVE-2026-78301 A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a
CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate int
CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged un
CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed
CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with
CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend dispropo
CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negativ

Version: 1:9.18.39-0ubuntu0.22.04.6 2026-08-31 12:07:34 UTC

bind9 (1:9.18.39-0ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3
    both present
    - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could
      find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,
      lib/dns/resolver.c, lib/ns/query.c.
    - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname
      mismatch in
      bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,
      bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,
      bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests
      /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_
      runtime_check.py.
    - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,
      bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/
      system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-13204

 -- Marc Deslauriers Thu, 27 Aug 2026 10:11:12 -0400
Source diff to previous version
CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B

Version: 1:9.18.39-0ubuntu0.22.04.5 2026-08-19 15:07:36 UTC
No changelog available yet.
Source diff to previous version

Version: 1:9.18.39-0ubuntu0.22.04.4 2026-05-21 20:07:35 UTC

  bind9 (1:9.18.39-0ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: BIND 9 server memory exhaustion during GSS-API TKEY
    negotiation
    - debian/patches/CVE-2026-3039-pre1.patch: Release gnamebuf also on the
      error path in lib/dns/gssapictx.c.
    - debian/patches/CVE-2026-3039-1.patch: Fix GSS-API context leak in TKEY
      negotiation in lib/dns/gssapictx.c, lib/dns/include/dst/gssapi.h,
      lib/dns/tkey.c.
    - debian/patches/CVE-2026-3039-3.patch: Fix output token and GSS context
      leaks in TKEY/GSS-API error paths in lib/dns/gssapictx.c,
      lib/dns/tkey.c.
    - CVE-2026-3039
  * SECURITY UPDATE: Amplification vulnerabilities via self-pointed glue
    records
    - debian/patches/CVE-2026-3592-1.patch: Limit the number of addresses
      returned per ADB find in bin/named/main.c, lib/dns/adb.c.
    - debian/patches/CVE-2026-3592-2.patch: Remove duplicate addresses from
      the resolver SLIST in lib/dns/resolver.c.
    - debian/patches/CVE-2026-3592-3.patch: Add system test for self-pointed
     glue deduplication in bin/tests/system/selfpointedglue/ns1/named.conf.j2,
      bin/tests/system/selfpointedglue/ns1/root.db,
      bin/tests/system/selfpointedglue/ns2/named.conf.j2,
      bin/tests/system/selfpointedglue/ns2/tld.db,
      bin/tests/system/selfpointedglue/ns3/example.tld.db,
      bin/tests/system/selfpointedglue/ns3/example2.tld.db,
      bin/tests/system/selfpointedglue/ns3/named.conf.j2,
      bin/tests/system/selfpointedglue/ns4/named.args.j2,
      bin/tests/system/selfpointedglue/ns4/named.conf.j2,
      bin/tests/system/selfpointedglue/ns4/root.hint,
      bin/tests/system/selfpointedglue/prereq.sh,
      bin/tests/system/selfpointedglue/tests_selfpointedglue.py.
    - debian/patches/CVE-2026-3592-5.patch: Add SRTT-based server selection
      system test in bin/tests/system/srtt/README,
      bin/tests/system/srtt/ans2/ans.py, bin/tests/system/srtt/ans3/ans.py,
      bin/tests/system/srtt/ans4/ans.py, bin/tests/system/srtt/ans5/ans.py,
      bin/tests/system/srtt/ns1/named.conf.j2,
      bin/tests/system/srtt/ns1/root.db, bin/tests/system/srtt/ns6/named.args,
      bin/tests/system/srtt/ns6/named.conf.j2, bin/tests/system/srtt/prereq.sh,
      bin/tests/system/srtt/srtt_ans.py, bin/tests/system/srtt/tests_srtt.py.
    - CVE-2026-3592
  * SECURITY UPDATE: Invalid handling of CLASS != IN
    - debian/patches/CVE-2026-5946-1.patch: Disable recursion for non-IN
      classes in bin/named/server.c, bin/tests/system/checkconf/tests.sh,
      bin/tests/system/resolver/tests.sh, lib/bind9/check.c.
    - debian/patches/CVE-2026-5946-2.patch: Disable UPDATE and NOTIFY for
      non-IN classes in bin/named/server.c, lib/dns/adb.c,
      lib/ns/client.c, lib/ns/update.c.
    - debian/patches/CVE-2026-5946-3.patch: Validate DNS message CLASS early
      in request processing in bin/tests/system/unknown/tests.sh,
      lib/ns/client.c.
    - debian/patches/CVE-2026-5946-4.patch: Reject meta-classes in UPDATE and
      NOTIFY messages in lib/dns/message.c.
    - debian/patches/CVE-2026-5946-5.patch: Skip "deny-answer-address" for
      non-IN addresses in lib/dns/resolver.c.
    - debian/patches/CVE-2026-5946-6.patch: Test CHAOS view recursion behavior
      in bin/tests/system/checkconf/tests.sh,
      bin/tests/system/checkconf/warn-chaos-recursion.conf,
      bin/tests/system/class/ns1/chaos.db.in,
      bin/tests/system/class/ns1/named.conf.j2,
      bin/tests/system/class/ns2/example.db.in,
      bin/tests/system/class/ns2/localhost.db.in,
      bin/tests/system/class/ns2/named.conf.j2,
      bin/tests/system/class/ns3/named.conf.j2, bin/tests/system/class/setup.sh,
      bin/tests/system/class/tests_class_chaos.py,
      bin/tests/system/isctest/check.py.
    - debian/patches/CVE-2026-5946-7.patch: Test UPDATE behavior in CHAOS and
      other non-IN classes in bin/named/server.c,
      bin/tests/system/class/ns2/localhost.db.in,
      bin/tests/system/class/tests_class_update.py.
    - debian/patches/CVE-2026-5946-8.patch: Test server behavior when sending
      various UPDATE requests in bin/tests/system/class/tests_class_update.py,
      bin/tests/system/nsupdate/setup.sh, bin/tests/system/nsupdate/tests.sh,
      bin/tests/system/packet.pl.
    - debian/patches/CVE-2026-5946-9.patch: Make the RD flag optional in
      isctest.query() in bin/tests/system/isctest/query.py.
    - CVE-2026-5946
  * SECURITY UPDATE: Unbounded resend loop in BIND 9 resolver
    - debian/patches/CVE-2026-5950-1.patch: Add reproducer for BADCOOKIE
      resend loop in bin/tests/system/resend_loop/ans3/ans.py,
      bin/tests/system/resend_loop/ns4/named.conf.j2,
      bin/tests/system/resend_loop/ns4/root.hint,
      bin/tests/system/resend_loop/tests_resend_loop.py.
    - debian/patches/CVE-2026-5950-2.patch: Refactor incrementing query
      counters in lib/dns/resolver.c.
    - debian/patches/CVE-2026-5950-3.patch: rctx_resend() increment query
      counters in lib/dns/resolver.c.
    - CVE-2026-5950

 -- Marc Deslauriers <email address hidden> Thu, 21 May 2026 10:42:08 -0400
Source diff to previous version
CVE-2026-3039 BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving an
CVE-2026-3592 BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone
CVE-2026-5946 Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `
CVE-2026-5950 An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated atta

Version: 1:9.18.39-0ubuntu0.22.04.3 2026-03-25 20:08:06 UTC

  bind9 (1:9.18.39-0ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Excessive NSEC3 iterations cause high CPU load during
    insecure delegation validation
    - debian/patches/CVE-2026-1519-1.patch: add reproducers to bin/tests/*.
    - debian/patches/CVE-2026-1519-2.patch: check iterations in
      isdelegation() in lib/dns/validator.c.
    - debian/patches/CVE-2026-1519-3.patch: don't verify already trusted
      rdatasets in lib/dns/include/dns/types.h, lib/dns/validator.c.
    - debian/patches/CVE-2026-1519-4.patch: check RRset trust in
      validate_neg_rrset() in lib/dns/validator.c.
    - CVE-2026-1519

 -- Marc Deslauriers <email address hidden> Tue, 24 Mar 2026 11:31:16 -0400
CVE-2026-1519 Excessive NSEC3 iterations cause high CPU load during insecure delegation validation


About   -   Send Feedback to @ubuntu_updates