* SECURITY UPDATE: named could terminate unexpectedly when concurrent messages signed or verified with the same GSS-TSIG key raced on its shared security context - debian/patches/CVE-2026-94300.patch: serialize access to the shared GSS-TSIG security context (upstream dcb8b7cbc7) - CVE-2026-94300 * SECURITY UPDATE: a resolver with a redirect zone and qname-minimization strict could abort while processing the redirect - debian/patches/CVE-2026-96888.patch: handle qname-minimization failures when redirecting, and clear the AD flag on a redirect NXRRSET (upstream b1bb41767d, 60dc845e57) - CVE-2026-96888 * SECURITY UPDATE: a crafted DNS message could make named spend disproportionate CPU time following chains of compression pointers - debian/patches/CVE-2026-19630.patch: limit how many compression pointers a name and a message may make named follow (upstream d3cd0a1387); keeps the budget out of struct dns_decompress to keep the libdns ABI - CVE-2026-19630 * SECURITY UPDATE: a recursive resolver with two RPZ zones of different recursive-only settings could abort on a non-recursive query that followed a recursive one - debian/patches/CVE-2026-97313.patch: only restore the recursionok flag after RPZ-initiated recursion when the client asked for and may have recursion (upstream 6823773725) - CVE-2026-97313