packages/net/bind, branch master

bind: bump to 9.20.26

2026-07-24T08:50:58Z

Fixes several security issues: - CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long. - CVE-2026-11721 Invalid signed wildcard records were being accepted. - CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field. - CVE-2026-10723 Correct verification of NSEC3 signer name. - CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries. - CVE-2026-10822 Malformed DNSKEY records could trigger an assertion. - CVE-2026-11605 Prevent excessive validation work from crafted negative responses. - CVE-2026-11622 Prevent cache exhaustion under sustained attack. Full release notes are available upstream at https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: add version check override

2026-05-29T13:25:01Z

Add version check override script. Signed-off-by: George Sapkin

bind: bump to 9.20.23

2026-05-29T13:25:01Z

Resolves several security issues: - CVE-2026-3592: Limit resolver server list size. - CVE-2026-3039: Fix GSS-API resource leak. - CVE-2026-5950: Avoid unbounded recursion loop. - CVE-2026-5947: Fix crash in resolver when SIG(0)-signed responses are received under load. - CVE-2026-3593: Add system test for HTTP/2 SETTINGS frame flood. - CVE-2026-5946: Disable recursion, UPDATE, and NOTIFY for non-IN views. Complete list of changes is available upstream at https://ftp.isc.org/isc/bind9/9.20.23/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans

bind: prevent mismatch of bind-libs version

2026-04-07T18:59:27Z

When upgrading specific packages manually, like: apk upgrade bind-dig the bind-libs package is not upgraded automatically, which results in problems when running the program, for example: root@OpenWrt:~# dig Error loading shared library libisc-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error loading shared library libdns-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error loading shared library libisccfg-9.20.10.so: No such file or directory (needed by /usr/bin/dig) Error relocating /usr/bin/dig: cfg_map_getname: symbol not found Error relocating /usr/bin/dig: irs_resconf_getndots: symbol not found Error relocating /usr/bin/dig: isc_managers_destroy: symbol not found Error relocating /usr/bin/dig: dns_fixedname_init: symbol not found Error relocating /usr/bin/dig: isc_nm_read: symbol not found Error relocating /usr/bin/dig: dns_rdata_init: symbol not found Error relocating /usr/bin/dig: isc_random_uniform: symbol not found [...] This has happened to me twice on OpenWRT 24.10. To fix this, enforce that the version of bind-libs matches the version of any dependent packages. Use the same approach as in net/knot/Makefile: make the dependency be present twice, once in the DEPENDS variable, the other one in the EXTRA_DEPENDS variable. Also, add an explicit EXTRA_DEPENDS variable to other internal dependencies. For example, versions of the bind-server-filter-aaaa and bind-server packages must match. Tested on snapshot, on x86/64. Signed-off-by: Mateusz Jończyk

bind: bump to 9.20.21

2026-03-31T11:42:09Z

Fixes several security issues: - CVE-2026-1519 Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. - CVE-2026-3104 Fix memory leaks in code preparing DNSSEC proofs of non-existence. - CVE-2026-3119 Prevent a crash in code processing queries containing a TKEY record. - CVE-2026-3591 Fix a stack use-after-return flaw in SIG(0) handling code. Signed-off-by: Noah Meyerhans

bind: backport patch replace automatic empty zones

2026-02-01T14:01:50Z

The RFC-1918 zones are automatically synthesized locally by bind to avoid forwarding queries about them to root nameservers. As a result, we can't easily replace them with rndc addzone on the fly. We need this for DHCP integration. Signed-off-by: Philip Prindeville

bind: bump to 9.20.18

2026-01-24T08:05:56Z

Fixes security issues: - CVE-2025-13878: Malformed BRID and HHIT records could trigger an assertion failure. Signed-off-by: Noah Meyerhans

bind: manual fix for IPv6 server unreachable noise

2025-12-13T01:06:44Z

Until we have a failsafe way of detecting no IPv6 internet connectivity automatically, allow the users to set it manually for now. Signed-off-by: Philip Prindeville

bind: save out served domains on service stop

2025-12-06T21:05:05Z

If named gets stopped, then started again, but isc-dhcpd isn't also restarted, then we want named to at least have the existing content. Signed-off-by: Philip Prindeville

bind: bump to 9.20.15

2025-10-22T23:12:41Z

Fixes the following security issues: - CVE-2025-8677: DNSSEC validation fails if matching but invalid DNSKEY is found. - CVE-2025-40778 Address various spoofing attacks. - CVE-2025-40780 Cache-poisoning due to weak pseudo-random number generator. The complete list of changes from version 9.20.11 is available in the upstream changelog at https://ftp.isc.org/isc/bind9/9.20.15/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans