WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-08-17 21:25:50 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,472 Commits 29 Branches 215 Tags
c163fbc505283b1900d4ff10708ae6e2665239af
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
W.C.A. Wijngaards c163fbc505 - Unit test for CVE-2026-55717. 2026-07-22 12:03:48 +02:00
W.C.A. Wijngaards eed3f1ab38 - Unit test for CVE-2026-50248. 2026-07-22 12:00:19 +02:00
W.C.A. Wijngaards 63501f51bb - Unit test for CVE-2026-50243. 2026-07-22 11:59:36 +02:00
W.C.A. Wijngaards 1ae2570bda - Unit test for CVE-2026-46582. 2026-07-22 11:58:18 +02:00
W.C.A. Wijngaards 9ad825b267 - Unit test for CVE-2026-50045. 2026-07-22 11:57:13 +02:00
W.C.A. Wijngaards 3d5e6c0692 - Unit test for CVE-2026-44690. 2026-07-22 11:56:08 +02:00
W.C.A. Wijngaards 23e19ca6fc - Unit test for CVE-2026-44687. 2026-07-22 11:55:09 +02:00
W.C.A. Wijngaards 9f757aa9f3 - Unit test for CVE-2026-42955. 2026-07-22 11:54:00 +02:00
W.C.A. Wijngaards 1df6c170ff Changelog entry for 1.25.2. 
- Set the repository to 1.25.3, it continues with the previous
  changes.
 2026-07-22 11:38:48 +02:00
W.C.A. Wijngaards 7a95bedc26 Fix conflict merge fixup. 2026-07-22 11:36:06 +02:00
W.C.A. Wijngaards ae685bc33d Move repo to version 1.25.3. 2026-07-22 11:34:48 +02:00
W.C.A. Wijngaards 91ac449bcd Merge branch 'branch-1.25.2' 2026-07-22 11:33:54 +02:00
W.C.A. Wijngaards c33ad1b1a2 rerun autoconf. 2026-07-22 10:21:21 +02:00
W.C.A. Wijngaards 84d9682dd0 - Fix CVE-2026-56444, Degradation of resolution service when 
'discard-timeout' and 'serve-expired-client-timeout' are combined in
  unusual configuration. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report. In addition, thanks to Xin Wang, Jiapeng Li,
  and Jiajia Liu, Northwestern Polytechnical University, for also
  reporting this issue. In addition, thanks to Haruki Oyama (Waseda
  University), for also reporting this issue.
 2026-07-22 10:19:50 +02:00
W.C.A. Wijngaards 4b1635e194 - Fix CVE-2026-56416, Possible heap buffer overflow when validator 
canonicalizes RDATA that contains domain name. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:19:28 +02:00
W.C.A. Wijngaards aac261cbb3 - Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control 
assertion failure in libngtcp2. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report. In addition, thanks to Xuanchao Xie,
  for also reporting this issue.
 2026-07-22 10:19:02 +02:00
W.C.A. Wijngaards ae1b3810cc - Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured 
Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:18:41 +02:00
W.C.A. Wijngaards 96f8755520 - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer 
overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:18:16 +02:00
W.C.A. Wijngaards 2ce2ca3691 - Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' 
CNAME redirect could lead to a crash. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report. In addition, thanks to Xin Wang,
  Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University,
  for also reporting this issue.
 2026-07-22 10:17:32 +02:00
W.C.A. Wijngaards c29ff70f6a - Fix CVE-2026-55708, Privacy/configuration issue when adding local 
data in views through 'unbound-control'. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-07-22 10:17:10 +02:00
W.C.A. Wijngaards 8a15ffee62 - Fix CVE-2026-54478, DNS Cookie bypass when combined with 
proxy-protocol use. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:16:42 +02:00
W.C.A. Wijngaards 8c702de175 - Fix CVE-2026-52863, Memory corruption could lead to crash and 
denial of service. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:16:03 +02:00
W.C.A. Wijngaards 804cff4c15 - Fix CVE-2026-50252, Possible cache poisoning attack by mapping 
source port population per thread. Thanks to Inbal Schussheim and
  Amit Klein, Hebrew University, for the report.
 2026-07-22 10:15:31 +02:00
W.C.A. Wijngaards e180b06298 - Fix CVE-2026-50251, Attacker supplied 0.0.0.0/:: glue triggers 
defensive full-cache flush. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-22 10:15:02 +02:00
W.C.A. Wijngaards 3530c81e29 - Fix CVE-2026-50248, BOGUS configured primary hostname accepted for 
XFR in auth/rpz zones. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-07-22 10:14:35 +02:00
W.C.A. Wijngaards 02b16de1ae - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers 
instead of returning SERVFAIL. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-22 10:14:04 +02:00
W.C.A. Wijngaards 1ad8d4c395 - Fix CVE-2026-50046, Possible heap use-after-free in an error path 
when a DoT forwarded query is jostled out. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-07-22 10:13:36 +02:00
W.C.A. Wijngaards 364ac737f7 - Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation 
restarts. Thanks to Kunjie Shang, University of Science and
  Technology of China, for the report.
 2026-07-22 10:13:14 +02:00
W.C.A. Wijngaards f7637a4f18 - Fix CVE-2026-44690, Cross-zone wildcard cache poisoning via 
RRSIG.labels manipulation. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-07-22 10:12:38 +02:00
W.C.A. Wijngaards 1e1940383a - Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain' 
logic can shadow a stub/forward zone by a legitimate parent's
  NXDOMAIN. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:12:03 +02:00
W.C.A. Wijngaards f52a9e864b - Fix CVE-2026-44621, Libunbound applications configured with 
'unwanted-reply-threshold' could eventually be abruptly
  terminated. Thanks to Qifan Zhang, Palo Alto Networks, for the
  report.
 2026-07-22 10:11:26 +02:00
W.C.A. Wijngaards 13ec8d0f26 - Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp 
the TTL of A/AAAA records disallowing a one-time 'ghost domain'
  delegation renewal via glue records. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-07-22 10:11:04 +02:00
W.C.A. Wijngaards 27f22b8808 - Fix CVE-2026-41637, Degradation of resolution service from 
improperly accounted client-terminated DNS-over-QUIC queries. Thanks
  to Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:10:24 +02:00
W.C.A. Wijngaards f54e0791ba - Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks 
to Qifan Zhang, Palo Alto Networks, for the report. In addition,
  thanks to Trung Nguyen (@everping) of CyStack, for also reporting
  this issue.
 2026-07-22 10:09:50 +02:00
W.C.A. Wijngaards 01dfd2f466 - Fix CVE-2026-32665, Remote DNS-over-QUIC denial of 
service due to `quic-size` budget bypass. Thanks to N0zoM1z0
  (https://github.com/N0zoM1z0) for the report. In addition, thanks to
  Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University,
  for also reporting this issue. In addition, thanks to Qifan Zhang,
  Palo Alto Networks, for also reporting this issue. In addition,
  thanks to Xuanchao Xie, for also reporting this issue.
 2026-07-22 10:09:26 +02:00
W.C.A. Wijngaards f157c691bb - Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure 
in high concurrency DNS-over-QUIC environments. Thanks to Kunta
  Chu, Kaihua Wang, and Jianjun Chen from Tsinghua University,
  for the report.
 2026-07-22 10:08:48 +02:00
W.C.A. Wijngaards fea0ff550b - Fix CVE-2026-46582, A wildcard replay, as another piece of data, 
triggers poisoning in the serve expired reply path. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-07-22 10:07:52 +02:00
W.C.A. Wijngaards 87d59bfced Set version to 1.25.2 2026-07-22 10:06:30 +02:00
W.C.A. Wijngaards 25b2543e5e Changelog note for #1476 
- Merge #1476 from petrvaganoff: ipsecmod: fix possible deref
  on null after reply_find_answer_rrset().
 2026-07-21 11:57:14 +02:00
W.C.A. Wijngaards fac7584830 - Fix #1474: DoQ responses are never padded - pad-responses 
does not apply to comm_doq (RFC 9250 §5.4 MUST).
 2026-07-20 10:14:26 +02:00
W.C.A. Wijngaards 87f9258fb4 Changelog entry for #1475 
- Merge #1475 from petrvaganoff: ipsecmod: fix deref on null
  in ipsecmod-whitelist after OOM.
 2026-07-20 10:05:45 +02:00
W.C.A. Wijngaards ad9b12a863 - Fix unit test for malformed svcb for test on Windows. 2026-07-09 09:52:09 +02:00
W.C.A. Wijngaards 61ca4111a1 Changelog note and explanation comment for #1383 
- Merge #1383 from jdek: Fix randomness generation on
  macOS/iOS under chroot.
 2026-07-09 09:21:56 +02:00
W.C.A. Wijngaards ba4f8478e6 Add changelog note for #1087, remove copyright line as discussed, and 
compile fixes for newer local_zones_lookup, unused variable warnings
fixed, and also manual page description of the feature.
- Merge #1087: Overload `local_data_remove` to support removing
  specific records.
 2026-07-02 15:04:51 +02:00
W.C.A. Wijngaards f35561287a - iana portlist updated. 2026-06-30 12:38:33 +02:00
W.C.A. Wijngaards 672b9659cf - Fix #1469: dohclient: DoH POST missing content-length → :status 
400 from strict resolvers (Cloudflare, Mullvad).
 2026-06-30 12:14:00 +02:00
W.C.A. Wijngaards 1978add0cd - Merge #1467: daemon: fix DEREF_AFTER_NULL.EX.COND on 
worker_init. This fixes error handling if the worker
  stat_timer allocation has an out of memory error. That
  makes the server not crash later, attempting to use it.
 2026-06-26 13:44:27 +02:00
W.C.A. Wijngaards 65e23d4b6f - Merge #1465 from dag-erling: Add libunbound/remote.h. Add 
a shared header containing prototypes for functions that
  both ends of a remote control connection need to implement.
 2026-06-25 11:16:01 +02:00
W.C.A. Wijngaards 01a95108b3 - Fix warning about file_string_matches in unbound-checkconf. 2026-06-19 09:30:46 +02:00
W.C.A. Wijngaards f75d11821f - Fix to update github ci actions/checkout to v7. 2026-06-19 09:25:39 +02:00
W.C.A. Wijngaards 6aa5cfc903 - Fix for #1457: fix thread setname for thread start of 
dnstap, and fast_reload.
 2026-06-19 08:37:23 +02:00
W.C.A. Wijngaards 4c5082ad05 - Fix that fast_reload does not terminate the server if 
random init for DNS cookies fails. The data is only random
  generated if cookies are enabled, and the random data
  is necessary. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-17 16:15:15 +02:00
W.C.A. Wijngaards 5fb892a097 - Fix that fast_reload does not terminate the server 
on config read failure after malloc failure. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 16:10:48 +02:00
W.C.A. Wijngaards 55e9532d16 - Fix after malloc failure for stats, then it drains the pipe 
so the internal messaging stays correct. Also it does
  not exit the server if stats pipe communication fails.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 16:05:45 +02:00
W.C.A. Wijngaards fff6657cea - Fix that fast_reload does not terminate the server 
on malloc failure for dnstap, or if gethostname fails.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 16:02:21 +02:00
W.C.A. Wijngaards 45d1e75caf - Fix to check for malloc failure in rpz response create, 
for nodata and nxdomain, so it does not crash later.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:59:29 +02:00
W.C.A. Wijngaards b806f16c8b - Fix to check the return value of auth_xfer_create 
during fast_reload auth-zone add and change processing.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:57:30 +02:00
W.C.A. Wijngaards 8d3348c71b - Fix that malloc failure during edns subnet addrtree 
insert is checked, so it does not crash later. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:55:33 +02:00
W.C.A. Wijngaards e2cc14681e - Fix that malloc failure for rpz_strip_nsdname is 
checked and handled, so that it does not crash later.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:53:28 +02:00
W.C.A. Wijngaards 5ae979bb6e - Fix that on malloc failure during accept of TCP, the 
socket is not left to cause a read event loop. It uses
  slow-accept to delay accepting new connections, if
  that fails it drops the new connections. When the tcp
  connection usage is full, it waits for 50msec, to allow
  existing queries to be resolved. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-17 15:37:04 +02:00
W.C.A. Wijngaards 8f2fbd66fc - Fix that malloc failure for ngtcp2_conn_server_new 
cleans up reference that older ngtcp2 versions can leave.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:33:06 +02:00
W.C.A. Wijngaards b5909d8d22 - Fix that malloc failure in doq connection setup, does 
not crash in doq connection delete later. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:29:48 +02:00
W.C.A. Wijngaards fa8e94f155 - Fix that malloc failure for new_local_rrset for RPZ qname 
trigger RR insert does not crash. It does not link a
  partial RRset, and logs an error on failure, and cleans
  up the dname allocation. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-17 15:26:56 +02:00
W.C.A. Wijngaards cb5683aeae - Fix that malloc failure in dns64_inform_super does 
not set up a half-built reply for cache store, that could
  lead to a crash. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-17 15:23:25 +02:00
W.C.A. Wijngaards c9715724ec - Fix that unbound-control auth_zone_reload stops the 
server answering from the zone after a failure to read.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:20:22 +02:00
W.C.A. Wijngaards 78d9cfffd8 - Fix that malloc failure in auth-zone insert rr does 
not create an empty node and does not cause an infinite
  loop. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-17 15:16:21 +02:00
W.C.A. Wijngaards b47b1d048d - Fix that unbound-checkconf checks if an auth-zone download 
can overwrite another file, by filename collision.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-17 15:11:42 +02:00
W.C.A. Wijngaards 740952fb82 - Fix to remove debug from auth_transfer_limit test. 2026-06-17 11:38:24 +02:00
W.C.A. Wijngaards 5c550f4548 - Fix that after fast_reload the disown of the auth zone 
transfer task cleans the chunk list. Also fix the
  auth_transfer_limit test to use a forwarder for each type
  of failure, so the one is not blocked by the other waiting.
 2026-06-17 11:37:06 +02:00
W.C.A. Wijngaards 3d78cb8d9a - Fix for #1462: Fix that auth primary host name lookup 
allows CNAMEs.
 2026-06-16 11:13:47 +02:00
W.C.A. Wijngaards 1ab75c0043 - Fix after malloc failure the rrset_insert_rr in 
localzone processing, during RPZ qname trigger processing,
  the RRset retains its previous data correcly. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 10:59:37 +02:00
W.C.A. Wijngaards bebc8d516b - Fix incorrect cleanup after an allocation failure for 
a delegation point in a region. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-16 10:56:36 +02:00
W.C.A. Wijngaards a7debe7ff6 - Fix that after shared memory cannot be created, from 
`shm-enable`, the server does not crash. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-06-16 10:53:40 +02:00
W.C.A. Wijngaards 215e3920ef - Fix that after malloc failure in find_tag_datas, the 
local_alias is cleaned up. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-06-16 10:51:49 +02:00
W.C.A. Wijngaards aabf28aef5 - Fix incorrect cleanup after an allocation failure for 
a delegation point. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:49:50 +02:00
W.C.A. Wijngaards aa09835c90 - Fix for neater solution to clear log thread id after 
worker init failure. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:48:17 +02:00
W.C.A. Wijngaards 9b9e13b665 - Fix that libunbound pipe functions fail with error after 
an event base is set. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:44:41 +02:00
W.C.A. Wijngaards f72e11ef5b - Fix locking in libunbound ub_ctx_set_event call. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 10:42:39 +02:00
W.C.A. Wijngaards a45e54555d - Fix that dnscrypt configuration does not crash, due to 
inconsistency between secret and public keys. Also
  duplicate files are skipped. Thanks to Qifan Zhang, Palo
  Alto Networks, for the report.
 2026-06-16 10:40:10 +02:00
W.C.A. Wijngaards 4693c00c9f - Fix that after malloc failure in RPZ load a half built 
list does not crash later. The newly created RRset is
  linked after creation has succeeded. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-16 10:35:41 +02:00
W.C.A. Wijngaards 8fe23e0297 - Fix that for a zonefile only zone, if that file does not 
exist on server start, the server continues to start with
  a warning log message. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:26:25 +02:00
W.C.A. Wijngaards 8557788699 - Fix that after malloc failure a half-built local_alias does 
not crash the server. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 10:12:19 +02:00
W.C.A. Wijngaards 81a19ebeb3 - Fix that a signed wildcard NSEC, is checked before use, 
so it does not allow insecure DS proofs inappropriately.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 10:09:00 +02:00
W.C.A. Wijngaards 299df5ec77 - Fix that dns64 does not ignore the forward-no-cache and 
`stub-no-cache` options. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-16 09:52:46 +02:00
W.C.A. Wijngaards 6f9b6db7be - Fix that auth-zone, and RPZ zones, do not allow out-of-zone 
records. These are records that are not under the zone apex.
  The out-of-zone records are dropped from the zone contents.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 09:48:10 +02:00
W.C.A. Wijngaards 96f15b9160 - Fix that a half-written trust anchor file does not crash 
the server at runtime. It unlinks a wrong file from the list.
  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-16 09:45:10 +02:00
W.C.A. Wijngaards 159384c2a9 - Fix that when SVCB records cannot be written out, and 
are written in unknown format, that the zone read allows
  such unknown format SVCB records. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-16 09:36:33 +02:00
W.C.A. Wijngaards 621fc91453 - Fix to disallow $INCLUDE for secondary zones. Start up 
of server continues if a secondary zone fails to load.
  Failed loads clear the zone data, so there is no partial
  zone. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-16 09:30:52 +02:00
W.C.A. Wijngaards 543c49f76c - Fix that dns64 bypasses rpz-passthru rule during 
synthesis. This restricted more than necessary. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:50:42 +02:00
W.C.A. Wijngaards d0a760a587 - Fix misconfigured ipsecmod hook causing path name 
similarity with other file. The ipsecmod is changed for
  exec of the hook. The ipsecmod hook, if a script, has to
  start now with a line like `#!/bin/sh`. Thanks to Qifan
  Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:45:53 +02:00
W.C.A. Wijngaards f68cca4097 - Fix DNAME synthesis from cache that keeps use of 0TTL 
entries in a sliding window. It did not surpass RRSIG
  expiry. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:39:34 +02:00
W.C.A. Wijngaards 3129357874 - Fix log of an aliased qname, to not use freed region 
memory. Thanks to Qifan Zhang, Palo Alto Networks, for
  the report.
 2026-06-15 16:34:17 +02:00
W.C.A. Wijngaards fc09352df6 - Fix that fast_reload does not terminate the server for 
errors in config, for key files. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-15 16:31:37 +02:00
W.C.A. Wijngaards 06da5d45a3 - Fix integer overflow for very high values of 
`sock-queue-timeout`. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-15 16:28:30 +02:00
W.C.A. Wijngaards 69524cadad - Fix erroneous DNS error report values after bogus AAAA 
query caused error information that was not cleared by
  a successful A subquery. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.
 2026-06-15 16:26:35 +02:00
W.C.A. Wijngaards 98e95d80e6 - Fix integer overflow in infra-cache-max-rtt calculation. 
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:22:50 +02:00
W.C.A. Wijngaards 2f8aa8a43a - Fix for fast_reload that removes an auth zone while its 
lookups are in progress, for a primary name. Also after the
  change, it no longer picks up the old results. Thanks to
  Qifan Zhang, Palo Alto Networks, for the report.
 2026-06-15 16:18:56 +02:00
W.C.A. Wijngaards 56e60e37ae - Fix that fast_reload when a zonemd verification lookup 
it in progress with subnet loaded, deregisters the
  callback. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 16:16:50 +02:00
W.C.A. Wijngaards 8f5348ab47 - Fix that misconfigured iter-scrub-ns: 0 causes request 
failures. Thanks to Qifan Zhang, Palo Alto Networks,
  for the report.
 2026-06-15 16:04:24 +02:00
W.C.A. Wijngaards c5d693b21c - Fix buffer overflow when configured with lower than 
default size and http transfer. Thanks to Qifan Zhang,
  Palo Alto Networks, for the report.
 2026-06-15 16:01:51 +02:00