Description of the patch:
This update for bind fixes the following issues:
Upgrade to release 9.20.26.
Security issues fixed:
- CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982).
- CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit (bsc#1271983).
- CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984).
- CVE-2026-11605: unnecessary validation of DNSSEC signed records (bsc#1271985).
- CVE-2026-11622: potential memory usage beyond configured limits (bsc#1271986).
- CVE-2026-11721: cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987).
- CVE-2026-12617: record ordering based unexpected exit with CNAME or DNAME (bsc#1271988).
- CVE-2026-13204: unexpected exit in certain situations with NSEC and NSEC3 both present (bsc#1271989).
- CVE-2026-13321: DNSSEC validation bypass via out-of-zone NSEC Next field (bsc#1271990).
Other updates and bugfixes:
- Release 9.20.26:
- Reclaim memory promptly when DNSSEC validations are canceled.
- Removed Features:
- Remove the secondary validator in query.c.
- Remove ineffective TCP fallback after repeated UDP timeouts.
- Feature Changes:
- Fall back to TCP on receipt of a UDP response with a mismatched
query ID.
- Limit the number of glue records cached from a referral.
- Fix a resolver stall on a CNAME response to a DS query.
- Bug Fixes:
- Fix a bug in DNS UPDATE processing with inline-signing enabled.
- Properly detect private records before copying.
- Tighten referral DS acceptance.
- Don't synthesize negative responses with pending NSEC.
- Check that an NSEC signer is at or above the name to be
validated.
- Don't evict DNSSEC-validated cache data on a CD=1 NXDOMAIN.
- Fix a deny-answer-aliases configuration bypass issue.
- Reject external referrals from forwarders.
- Fix a zone transfer over TLS (XoT) issue when using the
opportunistic TLS...