packages/net/bind/patches, branch master

bind: bump to 9.20.26

2026-07-24T08:50:58Z

Fixes several security issues: - CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long. - CVE-2026-11721 Invalid signed wildcard records were being accepted. - CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. - CVE-2026-10723 Correct verification of NSEC3 signer name. - CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries. - CVE-2026-10822 Malformed DNSKEY records could trigger an assertion. - CVE-2026-11605 Prevent excessive validation work from crafted negative responses. - CVE-2026-11622 Prevent cache exhaustion under sustained attack. Full release notes are available upstream at https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: bump to 9.20.23

2026-05-29T13:25:01Z

Resolves several security issues: - CVE-2026-3592: Limit resolver server list size. - CVE-2026-3039: Fix GSS-API resource leak. - CVE-2026-5950: Avoid unbounded recursion loop. - CVE-2026-5947: Fix crash in resolver when SIG(0)-signed responses are received under load. - CVE-2026-3593: Add system test for HTTP/2 SETTINGS frame flood. - CVE-2026-5946: Disable recursion, UPDATE, and NOTIFY for non-IN views. Complete list of changes is available upstream at https://ftp.isc.org/isc/bind9/9.20.23/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: bump to 9.20.21

2026-03-31T11:42:09Z

Fixes several security issues: - CVE-2026-1519 Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. - CVE-2026-3104 Fix memory leaks in code preparing DNSSEC proofs of non-existence. - CVE-2026-3119 Prevent a crash in code processing queries containing a TKEY record. - CVE-2026-3591 Fix a stack use-after-return flaw in SIG(0) handling code. Signed-off-by: Noah Meyerhans

bind: backport patch replace automatic empty zones

2026-02-01T14:01:50Z

The RFC-1918 zones are automatically synthesized locally by bind to avoid forwarding queries about them to root nameservers. As a result, we can't easily replace them with rndc addzone on the fly. We need this for DHCP integration. Signed-off-by: Philip Prindeville

bind: bump to 9.17.12

2021-04-29T19:39:46Z

Fixes the following security issues: * CVE-2021-25215 - named crashed when a DNAME record placed in the ANSWER section during DNAME chasing turned out to be the final answer to a client query. * CVE-2021-25214 - Insufficient IXFR checks could result in named serving a zone without an SOA record at the apex, leading to a RUNTIME_CHECK assertion failure when the zone was subsequently refreshed. This has been fixed by adding an owner name check for all SOA records which are included in a zone transfer. Signed-off-by: Noah Meyerhans

bind: update to 9.17.11

2021-03-22T03:38:25Z

Backport upstream OpenSSL deprecated API patch. Signed-off-by: Rosen Penev

bind: bump to 9.17.9

2021-01-29T17:10:31Z

Drop obsolete patches - 001-no-tests.patch - 002-fix-cross-compilation.patch Move several user-executable binaries from /usr/sbin to /usr/bin per upstream. Signed-off-by: Noah Meyerhans

bind: update to version 9.16.8

2020-10-31T13:39:05Z

- DNS Flag Day 2020 (default EDNS buffer size changed from 4096 to 1232 bytes) -- Added patch, which should be part of the next release It fixes an issue while cross-compilation (I linked it in the commit message with issue link) Signed-off-by: Josef Schlehofer

bind: update to 9.14.3

2019-06-26T23:25:44Z

Fixed CVE-2019-6471 ChangeLog: https://ftp.isc.org/isc/bind9/9.14.3/CHANGES Signed-off-by: Deng Qingfang

bind: update to 9.14.2

2019-05-18T16:16:41Z

BIND now requires POSIX thread and IPv6 support to build Add filter-AAAA plugin Remove unrecognized options Remove patch that no longer needed - 002-autoconf-ar-fix.patch Signed-off-by: Deng Qingfang