Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

Concurrent GSS-TSIG messages corrupt memory

Windows service and uninstall paths are not quoted when BIND is installed

Specific RPZ configurations and query patterns may result in an unexpected exit

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

Amplified resource exhaustion in inbound message processing

Validating resolver can abort while caching a mismatched NOQNAME proof

named aborts on a TKEY query when the user configuration has no global options statement

Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

SVCB AliasMode additional-data error leaks qpcache references

Unauthenticated remote crash of named via a single DoH SIG(0) request

Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

Unexpected exit in certain situations with NSEC and NSEC3 both present

Record ordering based unexpected exit with CNAME or DNAME

Cache poisoning possible with label count discrepancy, RRSIG, and wildcards

Potential memory usage beyond configured limits

Unnecessary validation of DNSSEC signed records

Potential wildcard CNAME RPZ policy bypass

Invalid handling of CLASS != IN

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

Memory leak in code preparing DNSSEC proofs of non-existence

Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

Some versions of BIND can improperly permit recursive query service to unauthorized clients

A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME

Improper fetch cleanup sequencing in the resolver can cause named to crash

A malformed request can trigger an assertion failure in badcache.c

BIND 9.12's serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.

A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named

Incorrect acceptance of NSEC3 records

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification

Key Record using PRIVATEDNS algorithm may lead to unexpected exit

Authenticated query containing a TKEY record may cause named to terminate unexpectedly

Update policies krb5-subdomain and ms-subdomain do not enforce controls promised in their documentation

NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof

qpcache NOQNAME proof use-after-free crashes recursive resolver

SIG(0) validation during query flood may lead to undefined behavior

Combination of DNS64 and RPZ Can Lead to Crash

An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c

An error in TSIG authentication can permit unauthorized dynamic updates

An error processing RPZ rules can cause named to loop endlessly after handling a query

An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

Out-of-zone database nodes can become authoritative zone cuts

A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching

Unbounded resend loop in BIND 9 resolver

Amplification vulnerabilities via self-pointed glue records