From 891837074d7705306cac298d331e78716ff538ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= Date: Fri, 13 Mar 2026 21:48:14 +0100 Subject: [PATCH] Generate changelog for BIND 9.18.47 --- doc/arm/changelog.rst | 1 + doc/changelog/changelog-9.18.47.rst | 32 +++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100644 doc/changelog/changelog-9.18.47.rst diff --git a/doc/arm/changelog.rst b/doc/arm/changelog.rst index 16e059b278..d23f225532 100644 --- a/doc/arm/changelog.rst +++ b/doc/arm/changelog.rst @@ -18,6 +18,7 @@ Changelog development. Regular users should refer to :ref:`Release Notes ` for changes relevant to them. +.. include:: ../changelog/changelog-9.18.47.rst .. include:: ../changelog/changelog-9.18.46.rst .. include:: ../changelog/changelog-9.18.45.rst .. include:: ../changelog/changelog-9.18.44.rst diff --git a/doc/changelog/changelog-9.18.47.rst b/doc/changelog/changelog-9.18.47.rst new file mode 100644 index 0000000000..402b03d097 --- /dev/null +++ b/doc/changelog/changelog-9.18.47.rst @@ -0,0 +1,32 @@ +.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") +.. +.. SPDX-License-Identifier: MPL-2.0 +.. +.. This Source Code Form is subject to the terms of the Mozilla Public +.. License, v. 2.0. If a copy of the MPL was not distributed with this +.. file, you can obtain one at https://mozilla.org/MPL/2.0/. +.. +.. See the COPYRIGHT file distributed with this work for additional +.. information regarding copyright ownership. + +BIND 9.18.47 +------------ + +Security Fixes +~~~~~~~~~~~~~~ + +- [CVE-2026-1519] Fix unbounded NSEC3 iterations when validating + referrals to unsigned delegations. ``5ef459eeaa9`` + + DNSSEC-signed zones may contain high iteration-count NSEC3 records, + which prove that certain delegations are insecure. Previously, a + validating resolver encountering such a delegation processed these + iterations up to the number given, which could be a maximum of 65,535. + This has been addressed by introducing a processing limit, set at 150. + Now, if such an NSEC3 record is encountered, the delegation will be + treated as insecure. + + ISC would like to thank Samy Medjahed/Ap4sh for bringing this + vulnerability to our attention. :gl:`#5708` + +