-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 21 Jul 2026 15:09:54 +0200
Source: bind9
Binary: bind9 bind9-dbgsym bind9-dev bind9-dnsutils bind9-dnsutils-dbgsym bind9-host bind9-host-dbgsym bind9-libs bind9-libs-dbgsym bind9-utils bind9-utils-dbgsym
Architecture: s390x
Version: 1:9.20.26-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: s390x Build Daemon (ziehrer) <buildd_s390x-ziehrer@buildd.debian.org>
Changed-By: Ondřej Surý <ondrej@debian.org>
Description:
 bind9      - Internet Domain Name Server
 bind9-dev  - Static Libraries and Headers used by BIND 9
 bind9-dnsutils - Clients provided with BIND 9
 bind9-host - DNS Lookup Utility
 bind9-libs - Shared Libraries used by BIND 9
 bind9-utils - Utilities for BIND 9
Changes:
 bind9 (1:9.20.26-1~deb13u1) trixie-security; urgency=high
 .
   * New upstream version 9.20.26
    + [CVE-2026-10723]: Correct verification of NSEC3 signer name.
    + [CVE-2026-10822]: Malformed DNSKEY records could trigger an
      assertion.
    + [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns
      too-long name.
    + [CVE-2026-11605]: Prevent excessive validation work from crafted
      negative responses.
    + [CVE-2026-11622]: Prevent cache exhaustion under sustained attack.
    + [CVE-2026-11721]: Stop accepting invalid signed wildcard records.
    + [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME
      queries.
    + [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response.
    + [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC
      Next Field.
Checksums-Sha1:
 27495d8ac9a560392e0ac75d14e8a1e79728f4a4 651756 bind9-dbgsym_9.20.26-1~deb13u1_s390x.deb
 df1a4b47ae12d71a3b9bad28fe3ef522e980b30a 296384 bind9-dev_9.20.26-1~deb13u1_s390x.deb
 4232a2a5c6594a1e25f5ba3873b415003b4eb3da 399600 bind9-dnsutils-dbgsym_9.20.26-1~deb13u1_s390x.deb
 084d9af2511521cefb5aff6a8f8bff0e11ffe81f 159916 bind9-dnsutils_9.20.26-1~deb13u1_s390x.deb
 f39d684a8c1b764f111a12fb5c54be87499edc78 104624 bind9-host-dbgsym_9.20.26-1~deb13u1_s390x.deb
 4411d1b29b6c7771b3fc8ca89f94c5ae5b65e853 53680 bind9-host_9.20.26-1~deb13u1_s390x.deb
 646fe3c57e1af3fad06081984091ae132d328f6f 4176400 bind9-libs-dbgsym_9.20.26-1~deb13u1_s390x.deb
 a8d7967c44e50adbc7de652394bafc175af5b34d 1156320 bind9-libs_9.20.26-1~deb13u1_s390x.deb
 0b0b028491a44fa1d9d6465079b4d4880e24505e 388272 bind9-utils-dbgsym_9.20.26-1~deb13u1_s390x.deb
 8c64e34d096a9becb8435bfc5f62560d6d00598a 177868 bind9-utils_9.20.26-1~deb13u1_s390x.deb
 b21638e95ee06abfb813d8dfc4173b1138272377 10451 bind9_9.20.26-1~deb13u1_s390x-buildd.buildinfo
 5f6d549ac017fb3dc25b67659bb4668eb21f2f27 244148 bind9_9.20.26-1~deb13u1_s390x.deb
Checksums-Sha256:
 d3626ba965a01c7ad90111afc984e463c267e27b3057b23a77f43a580282892f 651756 bind9-dbgsym_9.20.26-1~deb13u1_s390x.deb
 bfe4c4316260c559dfded91b25fcfad1d9d91c288f27332cdba7d2ab6a3854a8 296384 bind9-dev_9.20.26-1~deb13u1_s390x.deb
 64b8883017b1243b9d1ba93632fb116f72c8e8d9c9581979912b2d41cffbd835 399600 bind9-dnsutils-dbgsym_9.20.26-1~deb13u1_s390x.deb
 0402ab5682a616a8e600c9182118d1d1f90f5582419102c6c28564a16cc666e4 159916 bind9-dnsutils_9.20.26-1~deb13u1_s390x.deb
 d2253a4e9cf357f77355e2e799e042c5d964abbd7256a4f142d159a19334e336 104624 bind9-host-dbgsym_9.20.26-1~deb13u1_s390x.deb
 14c56561ef0883316c9f0d75fc7311b6393fd8ced1db32c99eff2086c566dd52 53680 bind9-host_9.20.26-1~deb13u1_s390x.deb
 119061036b2d644e0745d76decbc4984f0788e32d82592112fbbd5883e19efc8 4176400 bind9-libs-dbgsym_9.20.26-1~deb13u1_s390x.deb
 fde4799603d025e104af45a1122436573e7d8c4855bd38ed84702783105a3b08 1156320 bind9-libs_9.20.26-1~deb13u1_s390x.deb
 4a45abf2807a6fde9189145324740682f241b2c26a061e3b6573e68d22919968 388272 bind9-utils-dbgsym_9.20.26-1~deb13u1_s390x.deb
 7c59722fcf6f8e080357e0261342ebe577c7f5be248e10c1dab7aaaf6e841f65 177868 bind9-utils_9.20.26-1~deb13u1_s390x.deb
 d5dd7549998c4ab2d0da23469c1c37f8e7f733ee34c1e22c0af5a0f2fd4a00ce 10451 bind9_9.20.26-1~deb13u1_s390x-buildd.buildinfo
 e218ae79d338955f19af34ae042f2388a8592bfaa0ad8917be3dda67d8740c05 244148 bind9_9.20.26-1~deb13u1_s390x.deb
Files:
 b9cbe511cb503cf837cf1433a7def4c4 651756 debug optional bind9-dbgsym_9.20.26-1~deb13u1_s390x.deb
 c4604074dc648cf95ecc3f0fab2f4be2 296384 devel optional bind9-dev_9.20.26-1~deb13u1_s390x.deb
 7b72b6e269145e083a52880473a98318 399600 debug optional bind9-dnsutils-dbgsym_9.20.26-1~deb13u1_s390x.deb
 e0b9342e2164bf0844a560a5aef88f95 159916 net standard bind9-dnsutils_9.20.26-1~deb13u1_s390x.deb
 e919c417fa26d44b54867afa54c45ad9 104624 debug optional bind9-host-dbgsym_9.20.26-1~deb13u1_s390x.deb
 455a137411ab3b39ee473c240277d307 53680 net standard bind9-host_9.20.26-1~deb13u1_s390x.deb
 a66387556f2dcbb55b24d710b409a498 4176400 debug optional bind9-libs-dbgsym_9.20.26-1~deb13u1_s390x.deb
 46eca0f4414547b278bd356b360e86cc 1156320 libs standard bind9-libs_9.20.26-1~deb13u1_s390x.deb
 35f1f217437c0a7eb4d2c376ea89ce65 388272 debug optional bind9-utils-dbgsym_9.20.26-1~deb13u1_s390x.deb
 e01b0d0ed70912503ecfc6535a9b2e88 177868 net optional bind9-utils_9.20.26-1~deb13u1_s390x.deb
 2933c5d4c627a4934d90e6159512e6a3 10451 net optional bind9_9.20.26-1~deb13u1_s390x-buildd.buildinfo
 95bff9f606bda0b1d5b5c75d21ae3c02 244148 net optional bind9_9.20.26-1~deb13u1_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmpfdoYACgkQMWUFebkH
noQzmg/9G0N6T+qGHr7CVmcLmCSrncoS8DXuklXhIMOOc8uXBCP6Sr7e3JuLfAjf
NnROWXIWn4aPz/+RciG2joivrJUCekJWoj1cmRfNWn9QpW5yN0oM7zg7BcEoksgn
b/K22uimi9SBiF6G1HV4F8BG6JUa+tDu9xZGzLG+tVdELJTuPmM6HW68JArWwdIW
8mDo/P76f63ozzeWaxYPmEGO1C4m6/mq/ld6ZerU2NlcZZj/ACueWTpqGyp5k2K8
GsiIz9TnbcKRh/M20EjMC00c8GD0WC/pEjVhbiUYHe7TDVmaWE0fiZYu45kNXs6U
mvPOigtGSc0hpfpic5UHQ+ONAbp7V5tXqhxN5FVFUbBF1kMwmsG/GISVKW/9x6VF
EjqaRSc+RyKyPapK9YKbcoPHVUQDCbDfNx/P9hkAk3h0CY/Q9dX/pttotqFWRJxz
Fidir94mxtTjRr3cV2hS/L9cmaoKhyBDvqMEjZOf20ruO5wWwNp7ldTT6bxtO2hb
Am25lbusInSFbC/xjxeB4MNz3HDTvToksJ2rhMc1S010PR6Hkkn6H3YLeY5D+u87
s2u+8fOHveumtpNz53cxTh/g1g4k+LvuuwMEbJSHMJrQV/3mCae4GAGUNvk3/hyo
TOcq0jq0BYStmMrU9lhw6N0U5tutITvWlWRa7RHo0BxdJXrjShY=
=Xwi4
-----END PGP SIGNATURE-----