UbuntuUpdates.org

Package "dnsutils"

Name: dnsutils

Description:

Transitional package for bind9-dnsutils
Latest version: 1:9.18.39-0ubuntu0.24.04.8
Release: noble (24.04)
Level: security
Repository: universe
Head package: bind9
Homepage: https://www.isc.org/downloads/bind/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "dnsutils"

All arch deb package
APT INSTALL

Other versions of "dnsutils" in Noble

Repository Area Version
base universe 1:9.18.24-0ubuntu5
updates universe 1:9.18.39-0ubuntu0.24.04.7

Changelog

Version: 1:9.18.39-0ubuntu0.24.04.8 2026-10-14 14:07:55 UTC

bind9 (1:9.18.39-0ubuntu0.24.04.8) noble-security; urgency=medium

  * SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME
    records
    - debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in
      lib/dns/message.c.
    - debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated
      singleton records in a message in tests/dns/Makefile.am,
      tests/dns/message_test.c.
    - CVE-2026-75029
  * SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers
    - debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the
      DNS64 filter64 path in lib/ns/query.c.
    - debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path
      against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,
      bin/tests/system/dns64/ns2/named.conf.in, bin/tests/system/dns64/tests.sh.
    - CVE-2026-19666
  * SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC
    proofs
    - debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser
      proof caching in lib/dns/dnsrps.c, lib/dns/include/dns/rdataset.h,
      lib/dns/keytable.c, lib/dns/ncache.c, lib/dns/rbtdb.c,
      lib/dns/rdatalist.c, lib/dns/rdatalist_p.h, lib/dns/rdataset.c,
      lib/dns/resolver.c, lib/dns/sdb.c, lib/dns/sdlz.c, lib/ns/query.c.
    - debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders
      alive in lib/dns/rbtdb.c.
    - debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader
      lifetime in tests/dns/rbtdb_test.c.
    - CVE-2026-19662
  * SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof
    - debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from
      the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.
    - debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC
      wildcard proofs in bin/tests/system/Makefile.am,
      bin/tests/system/conf.sh.common,
      bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,
      bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys
      tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.
    - CVE-2026-19941
  * SECURITY UPDATE: Out-of-zone records served as authoritative
    - debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex
      are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,
      bin/tests/system/outofzone_zonecut/ns1/example.db,
      bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,
      bin/tests/system/outofzone_zonecut/ns1/root.db,
      bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,
      bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,
      bin/tests/system/outofzone_zonecut/ns2/nszone.db,
      bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,
      bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,
      bin/tests/system/outofzone_zonecut/ns3/nszone.db,
      bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.
    - debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin
      in RBT zone database lookups in lib/dns/rbtdb.c, tests/dns/rbtdb_test.c.
    - CVE-2026-78301
  * SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records
    - debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS
      AliasMode additional-data errors in
      bin/tests/system/additional/ns1/https.db,
      bin/tests/system/additional/ns1/named1.conf.in,
      bin/tests/system/additional/ns1/named2.conf.in,
      bin/tests/system/additional/ns1/named3.conf.in,
      bin/tests/system/additional/ns1/named4.conf.in,
      bin/tests/system/additional/ns2/root.db,
      bin/tests/system/additional/ns3/named.conf.in,
      bin/tests/system/additional/tests_https_alias.py.
    - debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB
      additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.
    - CVE-2026-81563
  * SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone
    - debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the
      insecure-referral proof in lib/dns/validator.c.
    - CVE-2026-77119
  * SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3
    proofs
    - debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection
      consistent in lib/dns/include/dns/rdataset.h,
      lib/dns/include/dns/validator.h, lib/dns/rdatalist.c,
      lib/dns/rdatalist_p.h, lib/dns/rdataset.c, lib/dns/resolver.c,
      lib/dns/validator.c, tests/dns/rbtdb_test.c.
    - debian/patches/CVE-2026-80274-2.patch: Test NOQNAME proof selection in the
      rdataset unit test in tests/dns/rdataset_test.c.
    - debian/patches/CVE-2026-80274-3.patch: Make the findnoqname mismatch
      system test reach the resolver in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py, bin/tests/system
      /dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-80274
  * SECURITY UPDATE: Zone transfer data used before TSIG verification
    - debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in
      lib/dns/xfrin.c.
    - CVE-2026-19033
  * SECURITY UPDATE: Excessive CPU usage via cached HTTPS/SVCB AliasMode records
    - debian/patches/CVE-2026-81736-1.patch: Bound the total additional
      processing for a single query in lib/ns/client.c,
      lib/ns/include/ns/client.h, lib/ns/query.c.
    - debian/patches/CVE-2026-81736-2.patch: Add a system test for SVCB/HTTPS
      AliasMode additional processing in
      bin/tests/system/additional/ns1/https.db,
      bin/tests/system/additional/tests_https_alias.py,
      bin/tests/system/svcb_alias/ns1/named.conf.j2,
      bin/tests/system/svcb_alias/ns1/root.hint,
      bin/tests/system/svcb_alias/ns2/named.conf.j2,
      bin/tests/system/svcb_alias/ns2/root.db,
      bin/tests/system/svcb_alias/setup.sh,
      bin/tests/system/svcb_alias/tests_svcb_
Source diff to previous version
CVE-2026-75029 In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is th
CVE-2026-19666 On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named`
CVE-2026-19662 An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-
CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an u
CVE-2026-78301 A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a
CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate int
CVE-2026-77119 A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged un
CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed
CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with
CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend dispropo
CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negativ

Version: 1:9.18.39-0ubuntu0.24.04.7 2026-08-31 12:07:40 UTC

bind9 (1:9.18.39-0ubuntu0.24.04.7) noble-security; urgency=medium

  * SECURITY UPDATE: Unexpected exit in certain situations with NSEC and NSEC3
    both present
    - debian/patches/CVE-2026-13204-1.patch: dns_rdataset_addnoqname() could
      find unsigned NSEC/NSEC3 in lib/dns/rbtdb.c, lib/dns/rdatalist.c,
      lib/dns/resolver.c, lib/ns/query.c.
    - debian/patches/CVE-2026-13204-2.patch: Reproducer for #5985 addnoqname
      mismatch in
      bin/tests/system/repro_5985_findnoqname_runtime_check/ans1/ans.py,
      bin/tests/system/repro_5985_findnoqname_runtime_check/ns2/named.conf.j2,
      bin/tests/system/repro_5985_findnoqname_runtime_check/server.py, bin/tests
      /system/repro_5985_findnoqname_runtime_check/tests_repro_5985_findnoqname_
      runtime_check.py.
    - debian/patches/CVE-2026-13204-3.patch: Update reproducer #5985 in
      bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py,
      bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2, bin/tests/
      system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py.
    - CVE-2026-13204

 -- Marc Deslauriers Thu, 27 Aug 2026 10:10:14 -0400
Source diff to previous version
CVE-2026-13204 If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then B

Version: 1:9.18.39-0ubuntu0.24.04.6 2026-08-19 15:08:55 UTC
No changelog available yet.
Source diff to previous version

Version: 1:9.18.39-0ubuntu0.24.04.5 2026-05-21 20:07:41 UTC

  bind9 (1:9.18.39-0ubuntu0.24.04.5) noble-security; urgency=medium

  * SECURITY UPDATE: BIND 9 server memory exhaustion during GSS-API TKEY
    negotiation
    - debian/patches/CVE-2026-3039-pre1.patch: Release gnamebuf also on the
      error path in lib/dns/gssapictx.c.
    - debian/patches/CVE-2026-3039-1.patch: Fix GSS-API context leak in TKEY
      negotiation in lib/dns/gssapictx.c, lib/dns/include/dst/gssapi.h,
      lib/dns/tkey.c.
    - debian/patches/CVE-2026-3039-3.patch: Fix output token and GSS context
      leaks in TKEY/GSS-API error paths in lib/dns/gssapictx.c,
      lib/dns/tkey.c.
    - CVE-2026-3039
  * SECURITY UPDATE: Amplification vulnerabilities via self-pointed glue
    records
    - debian/patches/CVE-2026-3592-1.patch: Limit the number of addresses
      returned per ADB find in bin/named/main.c, lib/dns/adb.c.
    - debian/patches/CVE-2026-3592-2.patch: Remove duplicate addresses from
      the resolver SLIST in lib/dns/resolver.c.
    - debian/patches/CVE-2026-3592-3.patch: Add system test for self-pointed
     glue deduplication in bin/tests/system/selfpointedglue/ns1/named.conf.j2,
      bin/tests/system/selfpointedglue/ns1/root.db,
      bin/tests/system/selfpointedglue/ns2/named.conf.j2,
      bin/tests/system/selfpointedglue/ns2/tld.db,
      bin/tests/system/selfpointedglue/ns3/example.tld.db,
      bin/tests/system/selfpointedglue/ns3/example2.tld.db,
      bin/tests/system/selfpointedglue/ns3/named.conf.j2,
      bin/tests/system/selfpointedglue/ns4/named.args.j2,
      bin/tests/system/selfpointedglue/ns4/named.conf.j2,
      bin/tests/system/selfpointedglue/ns4/root.hint,
      bin/tests/system/selfpointedglue/prereq.sh,
      bin/tests/system/selfpointedglue/tests_selfpointedglue.py.
    - debian/patches/CVE-2026-3592-5.patch: Add SRTT-based server selection
      system test in bin/tests/system/srtt/README,
      bin/tests/system/srtt/ans2/ans.py, bin/tests/system/srtt/ans3/ans.py,
      bin/tests/system/srtt/ans4/ans.py, bin/tests/system/srtt/ans5/ans.py,
      bin/tests/system/srtt/ns1/named.conf.j2,
      bin/tests/system/srtt/ns1/root.db, bin/tests/system/srtt/ns6/named.args,
      bin/tests/system/srtt/ns6/named.conf.j2, bin/tests/system/srtt/prereq.sh,
      bin/tests/system/srtt/srtt_ans.py, bin/tests/system/srtt/tests_srtt.py.
    - CVE-2026-3592
  * SECURITY UPDATE: Invalid handling of CLASS != IN
    - debian/patches/CVE-2026-5946-1.patch: Disable recursion for non-IN
      classes in bin/named/server.c, bin/tests/system/checkconf/tests.sh,
      bin/tests/system/resolver/tests.sh, lib/bind9/check.c.
    - debian/patches/CVE-2026-5946-2.patch: Disable UPDATE and NOTIFY for
      non-IN classes in bin/named/server.c, lib/dns/adb.c,
      lib/ns/client.c, lib/ns/update.c.
    - debian/patches/CVE-2026-5946-3.patch: Validate DNS message CLASS early
      in request processing in bin/tests/system/unknown/tests.sh,
      lib/ns/client.c.
    - debian/patches/CVE-2026-5946-4.patch: Reject meta-classes in UPDATE and
      NOTIFY messages in lib/dns/message.c.
    - debian/patches/CVE-2026-5946-5.patch: Skip "deny-answer-address" for
      non-IN addresses in lib/dns/resolver.c.
    - debian/patches/CVE-2026-5946-6.patch: Test CHAOS view recursion behavior
      in bin/tests/system/checkconf/tests.sh,
      bin/tests/system/checkconf/warn-chaos-recursion.conf,
      bin/tests/system/class/ns1/chaos.db.in,
      bin/tests/system/class/ns1/named.conf.j2,
      bin/tests/system/class/ns2/example.db.in,
      bin/tests/system/class/ns2/localhost.db.in,
      bin/tests/system/class/ns2/named.conf.j2,
      bin/tests/system/class/ns3/named.conf.j2, bin/tests/system/class/setup.sh,
      bin/tests/system/class/tests_class_chaos.py,
      bin/tests/system/isctest/check.py.
    - debian/patches/CVE-2026-5946-7.patch: Test UPDATE behavior in CHAOS and
      other non-IN classes in bin/named/server.c,
      bin/tests/system/class/ns2/localhost.db.in,
      bin/tests/system/class/tests_class_update.py.
    - debian/patches/CVE-2026-5946-8.patch: Test server behavior when sending
      various UPDATE requests in bin/tests/system/class/tests_class_update.py,
      bin/tests/system/nsupdate/setup.sh, bin/tests/system/nsupdate/tests.sh,
      bin/tests/system/packet.pl.
    - debian/patches/CVE-2026-5946-9.patch: Make the RD flag optional in
      isctest.query() in bin/tests/system/isctest/query.py.
    - CVE-2026-5946
  * SECURITY UPDATE: Unbounded resend loop in BIND 9 resolver
    - debian/patches/CVE-2026-5950-1.patch: Add reproducer for BADCOOKIE
      resend loop in bin/tests/system/resend_loop/ans3/ans.py,
      bin/tests/system/resend_loop/ns4/named.conf.j2,
      bin/tests/system/resend_loop/ns4/root.hint,
      bin/tests/system/resend_loop/tests_resend_loop.py.
    - debian/patches/CVE-2026-5950-2.patch: Refactor incrementing query
      counters in lib/dns/resolver.c.
    - debian/patches/CVE-2026-5950-3.patch: rctx_resend() increment query
      counters in lib/dns/resolver.c.
    - CVE-2026-5950
  * This package does _not_ contain the changes from
    1:9.18.39-0ubuntu0.24.04.4 in noble-proposed.

 -- Marc Deslauriers <email address hidden> Thu, 21 May 2026 09:51:13 -0400
Source diff to previous version
CVE-2026-3039 BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving an
CVE-2026-3592 BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone
CVE-2026-5946 Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `
CVE-2026-5950 An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated atta

Version: 1:9.18.39-0ubuntu0.24.04.3 2026-03-25 20:08:20 UTC

  bind9 (1:9.18.39-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: Excessive NSEC3 iterations cause high CPU load during
    insecure delegation validation
    - debian/patches/CVE-2026-1519-1.patch: add reproducers to bin/tests/*.
    - debian/patches/CVE-2026-1519-2.patch: check iterations in
      isdelegation() in lib/dns/validator.c.
    - debian/patches/CVE-2026-1519-3.patch: don't verify already trusted
      rdatasets in lib/dns/include/dns/types.h, lib/dns/validator.c.
    - debian/patches/CVE-2026-1519-4.patch: check RRset trust in
      validate_neg_rrset() in lib/dns/validator.c.
    - CVE-2026-1519

 -- Marc Deslauriers <email address hidden> Tue, 24 Mar 2026 11:25:46 -0400
CVE-2026-1519 Excessive NSEC3 iterations cause high CPU load during insecure delegation validation


About   -   Send Feedback to @ubuntu_updates