-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 16 Sep 2026 15:42:29 +0200
Source: bind9
Binary: bind9 bind9-dbgsym bind9-dev bind9-dnsutils bind9-dnsutils-dbgsym bind9-host bind9-host-dbgsym bind9-libs bind9-libs-dbgsym bind9-utils bind9-utils-dbgsym
Architecture: amd64
Version: 1:9.20.29-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Description:
 bind9      - Internet Domain Name Server
 bind9-dev  - Static Libraries and Headers used by BIND 9
 bind9-dnsutils - Clients provided with BIND 9
 bind9-host - DNS Lookup Utility
 bind9-libs - Shared Libraries used by BIND 9
 bind9-utils - Utilities for BIND 9
Changes:
 bind9 (1:9.20.29-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.29
    - [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC responses.
    - [CVE-2026-19033] Require a TSIG on every message of incoming zone
      transfers.
    - [CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via
      unrelated NSEC3 records.
    - [CVE-2026-19666] DNS64 with `break-dnssec` could cause an assertion
      failure.
    - [CVE-2026-19667] Reject oversized negative cache records.
    - [CVE-2026-19662] Prevent resolver crash with cached DNSSEC proofs.
    - [CVE-2026-75029] Discard repeated SOA, CNAME, and DNAME records when
      parsing DNS messages.
    - [CVE-2026-77692] Fix an unauthenticated crash on HTTPS using SIG(0).
    - [CVE-2026-81736] Cached HTTPS/SVCB aliases could exhaust resolver
      CPU.
    - [CVE-2026-76163] Prevent TKEY queries from terminating `named`
      without global options.
    - [CVE-2026-80274] Fix crash on wildcard answers carrying both NSEC and
      NSEC3 proofs.
    - [CVE-2026-81563] Following HTTPS/SVCB aliases could leak resolver
      cache memory.
Checksums-Sha1:
 cc187149eeb8524c7ba58dbf2e5bacbc947cea58 692836 bind9-dbgsym_9.20.29-1~deb13u1_amd64.deb
 42b6a87917ac11ac4eee74d203ce29ae8a4d86ac 297296 bind9-dev_9.20.29-1~deb13u1_amd64.deb
 1dc58ef70113f5445ad5645658c5af60ad65525a 438160 bind9-dnsutils-dbgsym_9.20.29-1~deb13u1_amd64.deb
 cfa5896fa09ec2e8abdb0665348b29fad0f7fef6 166948 bind9-dnsutils_9.20.29-1~deb13u1_amd64.deb
 c2004f4f62a625addd87fd3bd66e26aaa11077ad 107600 bind9-host-dbgsym_9.20.29-1~deb13u1_amd64.deb
 15ce1087264f797c5d78a6a23beffe5d601ae27f 56472 bind9-host_9.20.29-1~deb13u1_amd64.deb
 2b6f23bdbfc99d41b6b3d564d45837b32574e933 4233376 bind9-libs-dbgsym_9.20.29-1~deb13u1_amd64.deb
 346d2aa5b34432e369bac9dbdde7d1174f82c7e8 1248392 bind9-libs_9.20.29-1~deb13u1_amd64.deb
 91893680e49bd901bb739ad064e8e062203c04a5 501800 bind9-utils-dbgsym_9.20.29-1~deb13u1_amd64.deb
 4f48ee14a45c8b8881318ff80d1e96bc5e4e46b6 186644 bind9-utils_9.20.29-1~deb13u1_amd64.deb
 57834f6d36e2bb669c8b5c4c3496f404fac76d83 10644 bind9_9.20.29-1~deb13u1_amd64-buildd.buildinfo
 85cd761b665729fa994245564c2e7e66e601c8f8 257184 bind9_9.20.29-1~deb13u1_amd64.deb
Checksums-Sha256:
 b7308f2a4a0c64ee8838b4ae08b50fbba4a38b8fc0ac9eb46797f6fd8ff3bfbe 692836 bind9-dbgsym_9.20.29-1~deb13u1_amd64.deb
 70ad521ebb5dac7e6ab876437b266e02ac30e06403c6b26e123f6e4eb16e2026 297296 bind9-dev_9.20.29-1~deb13u1_amd64.deb
 aed3c936bfafa092dfe2a30ac3216b5bc421df7f6799672dac61874ceda9419e 438160 bind9-dnsutils-dbgsym_9.20.29-1~deb13u1_amd64.deb
 8b65cffec2f183ccbd6d73ee7cac852ae70172493d23dc14defad2c54e3faab8 166948 bind9-dnsutils_9.20.29-1~deb13u1_amd64.deb
 44ba4178353b8424ec1413773f1e5f19f66d49d28a85573b4685535e519b8253 107600 bind9-host-dbgsym_9.20.29-1~deb13u1_amd64.deb
 80f7933cb9e699f5f67e569be28a80fc804fd89f599fce06da217ca4cc0fe7c8 56472 bind9-host_9.20.29-1~deb13u1_amd64.deb
 0f37db0a26b6bb20809848f209d5cbd7ae28212bee6e8e1ec73599f65b2be95e 4233376 bind9-libs-dbgsym_9.20.29-1~deb13u1_amd64.deb
 9c28709dd3d9ca54cec00855b79fbd6e8181e8d062c024fe52aa4c03d2ed5cf4 1248392 bind9-libs_9.20.29-1~deb13u1_amd64.deb
 71e3b6279ff54b69d6c76405bbbd24f837508f7644cb281b8a793fdd57dfae59 501800 bind9-utils-dbgsym_9.20.29-1~deb13u1_amd64.deb
 6f53cd1af8adfeb557dc21386e09c66589cc31794ae36ad70a5c12de8b1fffc6 186644 bind9-utils_9.20.29-1~deb13u1_amd64.deb
 55f73c0876f35da580756d94357ae1b6821c11891cd6f383c47af6b0d6c3fac1 10644 bind9_9.20.29-1~deb13u1_amd64-buildd.buildinfo
 431d469704c061c9f480fc7e184b6c5ac72e3b1ac68acb50d5da601639049a10 257184 bind9_9.20.29-1~deb13u1_amd64.deb
Files:
 b58f90de9907c22b8960af293826e70c 692836 debug optional bind9-dbgsym_9.20.29-1~deb13u1_amd64.deb
 5d9b7bd97645d679efd847975cb7d4e8 297296 devel optional bind9-dev_9.20.29-1~deb13u1_amd64.deb
 fcdb86469dafd8fb05b5121b350efe71 438160 debug optional bind9-dnsutils-dbgsym_9.20.29-1~deb13u1_amd64.deb
 d01b57596c4d8a6a5eb5550c873c5d04 166948 net standard bind9-dnsutils_9.20.29-1~deb13u1_amd64.deb
 0208a472e83d782cd165c506a93c8dfe 107600 debug optional bind9-host-dbgsym_9.20.29-1~deb13u1_amd64.deb
 e9e94219172f64666926b45d3f53c4d1 56472 net standard bind9-host_9.20.29-1~deb13u1_amd64.deb
 a57233fc11e7a31681cdae626928de08 4233376 debug optional bind9-libs-dbgsym_9.20.29-1~deb13u1_amd64.deb
 b7b902e4ad662ade7bda1536429f3df1 1248392 libs standard bind9-libs_9.20.29-1~deb13u1_amd64.deb
 d225786c340cab311d2f3230a62c80de 501800 debug optional bind9-utils-dbgsym_9.20.29-1~deb13u1_amd64.deb
 a0f99cd399f863d87bb26db47673bee5 186644 net optional bind9-utils_9.20.29-1~deb13u1_amd64.deb
 0947ce7532f7d916762b970dfb0844bb 10644 net optional bind9_9.20.29-1~deb13u1_amd64-buildd.buildinfo
 49ff9d2f05597981e28bc9dd17ef6ea9 257184 net optional bind9_9.20.29-1~deb13u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmqqqC0ACgkQPkCWRKsh
20fcrg//amEKqehkQEl1ASYe1n/AcvxLxKcKXIOq5vgo2ED73H7XpgLdd+HGSbNK
Qu1k6vVHskSmgYYboVlyGqdupCdewBLtOQGRWyfk9t58JtYWadS756AAcJQGcHTm
gZukFxzcvseyTDKmFqswVC8s7lx8nYcvE5RiDeFtJdC3yWI4yAe1EHqXv4AIUQ2b
vgrG+1PRs8lCBDvHL8Kiq64036pslUxC4v9HjLArRQsMdTsJ5G/AUvaBUuX7pusH
K/B3x4nxSCSH79NSxM3te8hf8NyQOvuM8b+H3lVkNHQFzc+uQPFJNqVLtNjS4ihq
/BQU1Kd+HdTVPUocYsWHyedT3Kn7+amFIAVdOtTLT7IQaC0SCxRPLtu8cwxmkQl9
CVdH2CtYDa0SXYUS0/175bV+86DEBtDCLOv4ZIMGNCOQJkV25p7DgeCwPGfbk5ZN
uBmT2CF7nn14x9Qx+q/t8ur2nAhwGqx6ycY7Dfg059dR+KNiayeHbxMlQ5/G+/sM
QTNBNutSwUeHAs3wYz/BynFu592a+LWfhyJNFsto4w9A5sdr/gQOTPbPep5Kqd8t
NwUdp34ek9j5DekBeMfnM22gxcD2GsZBvOQJ0E3MNvaN22eWtIbf6lZ7584L6N9R
WvACDNukw07KPjbuLQpMamyzqkcko/V3LQw9jdv99XeJq13KZ24=
=zXl3
-----END PGP SIGNATURE-----