{"id":"CLSA-2026-1792648513","summary":"Fix of 13 CVEs","details":"   * SECURITY UPDATE: CPU exhaustion via malformed DNSKEY records\n     - debian/patches/CVE-2025-8677.patch: fail validation on invalid DNSKEY\n       in lib/dns/validator.c.\n     - CVE-2025-8677\n   * SECURITY UPDATE: cache poisoning through forged records in answers\n     - debian/patches/CVE-2025-40778.patch: tighten resolver caching rules\n       in lib/dns/resolver.c and lib/dns/message.c, and raise the default\n       max-recursion-queries from 32 to 50 in bin/named/config.c.\n     - CVE-2025-40778\n   * SECURITY UPDATE: assertion failure on malformed PRIVATEDNS DNSKEY records\n     - debian/patches/CVE-2026-10822.patch: make dns_name_fromwire() honour\n       the active region of the source buffer in lib/dns/name.c.\n     - CVE-2026-10822\n   * SECURITY UPDATE: crash from malformed NSEC/NSEC3 response\n     - debian/patches/CVE-2026-13204.patch: treat a missing NOQNAME proof as\n       an error instead of an assertion failure in lib/dns/rbtdb.c,\n       lib/dns/resolver.c and lib/ns/query.c.\n     - CVE-2026-13204\n   * SECURITY UPDATE: forged DNSSEC-validated NXDOMAIN responses\n     - debian/patches/CVE-2026-19941.patch: require NSEC wildcard proofs to\n       be signed by the same zone as the NOQNAME proof in\n       lib/dns/validator.c and lib/dns/include/dns/validator.h.\n     - CVE-2026-19941\n   * SECURITY UPDATE: DNSSEC validation bypass via NSEC3 impersonation\n     - debian/patches/CVE-2026-10723.patch: check that the NSEC3 signer\n       matches the owning zone in lib/dns/dnssec.c and lib/isc/result.c.\n     - CVE-2026-10723\n   * SECURITY UPDATE: excessive CPU use validating crafted DNSSEC responses\n     - debian/patches/CVE-2026-19668.patch: bound the DS-to-DNSKEY matching\n       during DNSSEC validation and make the exhausted quota terminal in\n       lib/dns/validator.c and lib/dns/resolver.c.\n     - CVE-2026-19668\n   * SECURITY UPDATE: use-after-free of cached NOQNAME proofs\n     - debian/patches/CVE-2026-19662.patch: keep the cache slabheader that\n       owns a NOQNAME or closest-encloser proof referenced while the proof\n       rdatasets are in use in lib/dns/rbtdb.c.\n     - CVE-2026-19662\n   * SECURITY UPDATE: out-of-zone data above the apex treated as a zone cut\n     - debian/patches/CVE-2026-78301.patch: ignore nodes above the zone\n       origin in RBT zone database lookups in lib/dns/rbtdb.c.\n     - CVE-2026-78301\n   * SECURITY UPDATE: sparsely signed incoming zone transfers accepted\n     - debian/patches/CVE-2026-19033.patch: require a TSIG on every message\n       of an incoming zone transfer in lib/dns/xfrin.c.\n     - CVE-2026-19033\n   * SECURITY UPDATE: memory amplification via duplicate singleton records\n     - debian/patches/CVE-2026-75029.patch: skip duplicate singleton\n       records when parsing DNS messages in lib/dns/message.c.\n     - CVE-2026-75029\n   * SECURITY UPDATE: DNSSEC downgrade of secure delegations via NSEC3\n     from an unrelated sibling zone\n     - debian/patches/CVE-2026-77119.patch: ignore NSEC3 records whose owner\n       zone does not enclose the DS name in the insecure delegation proof\n       in lib/dns/validator.c.\n     - CVE-2026-77119\n   * SECURITY UPDATE: invalid signed wildcard records accepted\n     - debian/patches/CVE-2026-11721.patch: reject RRSIG records whose labels\n       field is lower than the signer label count when parsing and\n       verifying in lib/dns/rdata/generic/rrsig_46.c and lib/dns/dnssec.c,\n       and do not sign out-of-zone records in bin/dnssec/dnssec-signzone.c.\n     - CVE-2026-11721","modified":"2026-10-26T09:43:52.034100877Z","published":"2026-10-22T05:55:37Z","upstream":["CVE-2025-40778","CVE-2025-8677","CVE-2026-10723","CVE-2026-10822","CVE-2026-11721","CVE-2026-13204","CVE-2026-19033","CVE-2026-19662","CVE-2026-19668","CVE-2026-19941","CVE-2026-75029","CVE-2026-77119","CVE-2026-78301"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792648513.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40778"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8677"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10723"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10822"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11721"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13204"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19033"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19662"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19668"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19941"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75029"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77119"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78301"}],"affected":[{"package":{"name":"bind9","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/bind9?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}},{"package":{"name":"bind9-dnsutils","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/bind9-dnsutils?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}},{"package":{"name":"bind9-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/bind9-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}},{"package":{"name":"bind9-host","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/bind9-host?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}},{"package":{"name":"bind9-libs","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/bind9-libs?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}},{"package":{"name":"bind9-utils","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/bind9-utils?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}},{"package":{"name":"bind9utils","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/bind9utils?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}},{"package":{"name":"dnsutils","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/dnsutils?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.18.30-0ubuntu0.20.04.2+tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1792648513.json"}}],"schema_version":"1.9.0"}