Accepted bind9 1:9.20.26-1~deb13u1 (source) into proposed-updates

--===============3932158724278477430==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 21 Jul 2026 15:09:54 +0200
Source: bind9
Architecture: source
Version: 1:9.20.26-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian DNS Team <[email protected]>
Changed-By: Ond=C5=99ej Sur=C3=BD <[email protected]>
Changes:
 bind9 (1:9.20.26-1~deb13u1) trixie-security; urgency=3Dhigh
 .
   * New upstream version 9.20.26
    + [CVE-2026-10723]: Correct verification of NSEC3 signer name.
    + [CVE-2026-10822]: Malformed DNSKEY records could trigger an
      assertion.
    + [CVE-2026-11331]: Fix handling of RPZ CNAME expansion that returns
      too-long name.
    + [CVE-2026-11605]: Prevent excessive validation work from crafted
      negative responses.
    + [CVE-2026-11622]: Prevent cache exhaustion under sustained attack.
    + [CVE-2026-11721]: Stop accepting invalid signed wildcard records.
    + [CVE-2026-12617]: Do not assert for some specific CNAME and DNAME
      queries.
    + [CVE-2026-13204]: Prevent crash from malformed NSEC/NSEC3 response.
    + [CVE-2026-13321]: Fix DNSSEC validation bypass via out-of-zone NSEC
      Next Field.
Checksums-Sha1:
 ec5a046277954de2875b9155aa29db816b1fcba9 2953 bind9_9.20.26-1~deb13u1.dsc
 9d323db5f1d6f3c4485ba916c746c58a56a7b002 5918032 bind9_9.20.26.orig.tar.xz
 c42f69f64358dbc2295d0c0cf2c12b6be417e42d 62424 bind9_9.20.26-1~deb13u1.debia=
n.tar.xz
 ab5240e9a0191330584bbf7349c4e78f1b250734 15038 bind9_9.20.26-1~deb13u1_amd64=
.buildinfo
Checksums-Sha256:
 b10b99ce94a98395328da4a7b66954fb90dfe71a6355b01cb0749e9d6af73eba 2953 bind9_=
9.20.26-1~deb13u1.dsc
 55248def0f870c4c46b3de72978ea972615131516663188a4564dca1d20bf350 5918032 bin=
d9_9.20.26.orig.tar.xz
 abbd2aa72a67d631d9d9fb8f6af15872a1ee7b5f1ef04018242ca5be4d174997 62424 bind9=
_9.20.26-1~deb13u1.debian.tar.xz
 894caf91a569453563fe52e81923dc5b939a4da41e45205ffb2efee515ea9eba 15038 bind9=
_9.20.26-1~deb13u1_amd64.buildinfo
Files:
 7d1a8c5436b7db80b654f4d75d54cca1 2953 net optional bind9_9.20.26-1~deb13u1.d=
sc
 5068ac935059607d485625f80c233568 5918032 net optional bind9_9.20.26.orig.tar=
.xz
 347a1418e7162c8f02574faef6dc7dcd 62424 net optional bind9_9.20.26-1~deb13u1.=
debian.tar.xz
 c99e6df6ba48961aa9316bf99487bfa9 15038 net optional bind9_9.20.26-1~deb13u1_=
amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEw2Gx4wKVQ+vGJel9g3Kkd++uWcIFAmpfcRZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEMz
NjFCMUUzMDI5NTQzRUJDNjI1RTk3RDgzNzJBNDc3RUZBRTU5QzIACgkQg3Kkd++u
WcLYBhAAidhcPysuyXFdn8a927FLcFFh9kknhD5w+rvqi0vX2RDBw35oCEkzNxSN
Avb4bVVYUIWm97rvveFd9W/aPKzb0ahjsY8OY33xYuanDj5anmu5gOWl4dx5SJZ3
1YJCDrfSrvLKCsiNxz+u7leTBYuwXEuhhRt+T+qTq6qP4puAfeVgo27Q7FhWRm+9
5UP4Wh7+kQ4fF6NshWgZ8O/wA+6S3UfOPdi1Uiga39ooSyW8tA0iIGGjhj/PqZ/R
3kKUkx2pzJWO66BrylGQnV43dD7RNSt2I25VCoxIGWJooHO6JiXlzXUbwVVwWVkP
nP2OkJpeoTD4whIAR1laelnnh1/L1VBKq3YTaiY0/msP47LeZuZZz8oAXgaVt6iB
vEY8102Y1AJCdvXdWJcBpEYC5dCU/SjejlXE2ovgth25X8DIwOCXZJDUSZQ/YvOO
4g3BBYiztGC8RvE8xx3ARJcCW6C+y8I7M7RqIRA1jj3A7A65Iy8wbrsz9yi5lxr7
SHYe3A6uAMSoH1oV3jmdOg+ND9r6NrGXIzr0zOmuD2YzT454CQmjsnmNw2PCs/6F
UQTLZ1HTjHdxYMKy/+iTNvpfXuYcqSrEsOfcdfNqXyjW2DFKRFRGC4Rckq6esilA
VBAAREv7kjL9sz7DOBNG7UbRk6P1soea2pBBZS4nMJDtbcdoDzE=3D
=3Dq8On
-----END PGP SIGNATURE-----


--===============3932158724278477430==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCamHDdQAKCRCb9qggYcy5
IWiZAQCM1OsbDgK/XEgEF3mxiI540WAr0NVQZalW5FJH66KhUAEAnbuHj2SJ4Xn9
WaEXBe7klIg85/NAY2luRngRWSsC/w4=
=a1yP
-----END PGP SIGNATURE-----

--===============3932158724278477430==--