-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 16 Sep 2026 15:42:29 +0200
Source: bind9
Architecture: source
Version: 1:9.20.29-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian DNS Team <team+dns@tracker.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Changes:
 bind9 (1:9.20.29-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.29
    - [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC responses.
    - [CVE-2026-19033] Require a TSIG on every message of incoming zone
      transfers.
    - [CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via
      unrelated NSEC3 records.
    - [CVE-2026-19666] DNS64 with `break-dnssec` could cause an assertion
      failure.
    - [CVE-2026-19667] Reject oversized negative cache records.
    - [CVE-2026-19662] Prevent resolver crash with cached DNSSEC proofs.
    - [CVE-2026-75029] Discard repeated SOA, CNAME, and DNAME records when
      parsing DNS messages.
    - [CVE-2026-77692] Fix an unauthenticated crash on HTTPS using SIG(0).
    - [CVE-2026-81736] Cached HTTPS/SVCB aliases could exhaust resolver
      CPU.
    - [CVE-2026-76163] Prevent TKEY queries from terminating `named`
      without global options.
    - [CVE-2026-80274] Fix crash on wildcard answers carrying both NSEC and
      NSEC3 proofs.
    - [CVE-2026-81563] Following HTTPS/SVCB aliases could leak resolver
      cache memory.
Checksums-Sha1:
 2e7f6108dd5e94ef80450f243705876b8889c0ec 3197 bind9_9.20.29-1~deb13u1.dsc
 3aea3e2a8a32bd14de8f5c528e5abab05716e29c 5966372 bind9_9.20.29.orig.tar.xz
 9d9e63e40f199d659c16dcaf2fb688486b853aee 870 bind9_9.20.29.orig.tar.xz.asc
 b3642bb1ebeb01500a2af9f585cff5371a041793 62728 bind9_9.20.29-1~deb13u1.debian.tar.xz
 d875fdac22e9c30177704b95ecd853070889f8b9 15181 bind9_9.20.29-1~deb13u1_amd64.buildinfo
Checksums-Sha256:
 8fa2bc720c1f0f4c6b100fe28a76a2e67362f27f94b4b182f9d084418fa11667 3197 bind9_9.20.29-1~deb13u1.dsc
 587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1 5966372 bind9_9.20.29.orig.tar.xz
 52f035d5d3af0caa9c7ad61b799e51b46ea451f777dec527ff238bfab68b62cd 870 bind9_9.20.29.orig.tar.xz.asc
 923460dfb8d9b7a706b55ef3d9e781de22553cd1c0513dc9a67f2b6735cb3e60 62728 bind9_9.20.29-1~deb13u1.debian.tar.xz
 67fa135cb80fd33bfe77e4d0a74ce9e1e942c544bc28b64f3e93f76a65993746 15181 bind9_9.20.29-1~deb13u1_amd64.buildinfo
Files:
 8690625ff5070b08635e089d19aae567 3197 net optional bind9_9.20.29-1~deb13u1.dsc
 b5b5051561311d3aebdcdb8b46d07675 5966372 net optional bind9_9.20.29.orig.tar.xz
 82f446d91963b0019d6a89e73a360d6b 870 net optional bind9_9.20.29.orig.tar.xz.asc
 407be2b166cb7ddb50c9d8ed6079ff52 62728 net optional bind9_9.20.29-1~deb13u1.debian.tar.xz
 ba1804759f41d2f577de948b2419bc88 15181 net optional bind9_9.20.29-1~deb13u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmqqoYFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcJhMg//fsF/gl2r38S4GKORON18rkHYMrwme+SocUORT8/84vjHIsNidxd0Zoiw
7UMfO79+ENjqhcpp8nWttB4EkWB6D4h9/fiU3dUNXb+RdSlYZgl4F4is2rP2X7wH
VH7FVX56miOL7jRcifj2oH7B+niNH9cKjYbnmYVEXWVEOcvrj5FjXcvlxciGyp1E
khY34Ec7kPSI4FYry3weT8L0Q+qlc+IqzUyh7QghoAeks2Pad5PNp+HVwaA+oRqm
7JyV0+y0F37orm5uDkNJ8r89FuDbSkf+mX4MefdUlXAGVUldsf3/5lzYdPNVv0U+
hrxrfMVPgsAg99oJIPNJg5tD4PN4zeuuE/wG4aL9Dq29x1HUxhJG7rHZHseNPs86
KhOYAX/PdabVXiYfDI3J7vc4KSM9L/Ls8cCLZ5AP4rGXV7bmZmMbSoTq6byaxtVl
Y1xh5mY81Z0fY81To7p7s1I+ubIjsvpAcswCXXBjJr13eNKJzAHj+d4jYXmxr2yO
wtg6Jw8XaHktlroH8WNb3BAJS9B/8ir7ltRB5IH88e2PixjuiiVwPpZBRO7ELal2
x3lAGKJcR5eMDhg9+3mXiqjq5OpbSGbPuajsuXymZZrC0ByZaYIXIGb9SLBy3tT9
ccqBtiAqws0Sqw+hPCjw2DyBWH7BY0dOdJyCbXe8pDywZX+mE1k=
=QcaY
-----END PGP SIGNATURE-----