- CVE-2026-81642: fix heap buffer overflow when digesting DNSKEY - CVE-2026-81634: add the missing first owner name and signature length bounds checks to rrset_canonical(), preventing a heap buffer overflow during RRset canonicalisation - CVE-2026-82717: restore the packet buffer position on malformed names in pkt_dname_len() and bound the copy lengths in rdata_copy(), preventing heap corruption on the CNAME synthesis error path - CVE-2026-85501: bound DNSSEC validation work per query: key-tag matches capped at 256, NSEC/NSEC3 verifications at 8 per message, new val-validation-attempts and val-hash-attempts options (default 32), oversized referral DS RRsets shortened to 20, and val-clean-additional now defaults to no