Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

isc-projects/bind9

              main @ 9927ad5
            

355

Fixes

CVEs

CRITICAL

Peak severity

44.1%

Coverage

Highlights

Denial of Service: 114 prior fixes. Scrutinize any change in this area.

lib/dns/resolver.c: most-fixed (75 issues). Treat as high-risk during review.

235 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

DNSSEC Validation Bypass: Multiple fixes address acceptance of unsigned or improperly-signed NSEC/NSEC3 records, incorrect signer name checks, and insecure-delegation proofs, allowing attackers to bypass DNSSEC and poison caches.

Cache Poisoning: A cluster of fixes enforce bailiwick and subdomain checks on referrals, glues, and NS RRsets, and restrict caching of out-of-zone or forwarder-sourced data. Inconsistent enforcement across paths (e.g., forwarders, additional sections) is a recurring risk.

Use-After-Free: Numerous fixes address lifetime management races in fetch contexts, TLS socket callbacks, and validator destruction. These are complex concurrency bugs that are hard to fully eliminate and can lead to memory corruption or crashes.