* SECURITY UPDATE: CPU exhaustion via malformed DNSKEY records - debian/patches/CVE-2025-8677.patch: fail validation on invalid DNSKEY in lib/dns/validator.c. - CVE-2025-8677 * SECURITY UPDATE: cache poisoning through forged records in answers - debian/patches/CVE-2025-40778.patch: tighten resolver caching rules in lib/dns/resolver.c and lib/dns/message.c, and raise the default max-recursion-queries from 32 to 50 in bin/named/config.c. - CVE-2025-40778 * SECURITY UPDATE: assertion failure on malformed PRIVATEDNS DNSKEY records - debian/patches/CVE-2026-10822.patch: make dns_name_fromwire() honour the active region of the source buffer in lib/dns/name.c. - CVE-2026-10822 * SECURITY UPDATE: crash from malformed NSEC/NSEC3 response - debian/patches/CVE-2026-13204.patch: treat a missing NOQNAME proof as an error instead of an assertion failure in lib/dns/rbtdb.c, lib/dns/resolver.c and lib/ns/query.c. - CVE-2026-13204 * SECURITY UPDATE: forged DNSSEC-validated NXDOMAIN responses - debian/patches/CVE-2026-19941.patch: require NSEC wildcard proofs to be signed by the same zone as the NOQNAME proof in lib/dns/validator.c and lib/dns/include/dns/validator.h. - CVE-2026-19941 * SECURITY UPDATE: DNSSEC validation bypass via NSEC3 impersonation - debian/patches/CVE-2026-10723.patch: check that the NSEC3 signer matches the owning zone in lib/dns/dnssec.c and lib/isc/result.c. - CVE-2026-10723 * SECURITY UPDATE: excessive CPU use validating crafted DNSSEC responses - debian/patches/CVE-2026-19668.patch: bound the DS-to-DNSKEY matching during DNSSEC validation and make the exhausted quota terminal in lib/dns/validator.c and lib/dns/resolver.c. - CVE-2026-19668 * SECURITY UPDATE: use-after-free of cached NOQNAME proofs - debian/patches/CVE-2026-19662.patch: keep the cache slabheader that owns a NOQNAME or closest-encloser proof referenced while the proof rdatasets are in use in lib/dns/rbtdb.c. - CVE-2026-19662 * SECURITY UPDATE: out-of-zone data above the apex treated as a zone cut - debian/patches/CVE-2026-78301.patch: ignore nodes above the zone origin in RBT zone database lookups in lib/dns/rbtdb.c. - CVE-2026-78301 * SECURITY UPDATE: sparsely signed incoming zone transfers accepted - debian/patches/CVE-2026-19033.patch: require a TSIG on every message of an incoming zone transfer in lib/dns/xfrin.c. - CVE-2026-19033 * SECURITY UPDATE: memory amplification via duplicate singleton records - debian/patches/CVE-2026-75029.patch: skip duplicate singleton records when parsing DNS messages in lib/dns/message.c. - CVE-2026-75029 * SECURITY UPDATE: DNSSEC downgrade of secure delegations via NSEC3 from an unrelated sibling zone - debian/patches/CVE-2026-77119.patch: ignore NSEC3 records whose owner zone does not enclose the DS name in the insecure delegation proof in lib/dns/validator.c. - CVE-2026-77119 * SECURITY UPDATE: invalid signed wildcard records accepted - debian/patches/CVE-2026-11721.patch: reject RRSIG records whose labels field is lower than the signer label count when parsing and verifying in lib/dns/rdata/generic/rrsig_46.c and lib/dns/dnssec.c, and do not sign out-of-zone records in bin/dnssec/dnssec-signzone.c. - CVE-2026-11721