Package: pdns-server Version: 4.9.17-0+deb13u1 Severity: important Tags: security upstream X-Debbugs-Cc: Debian Security Team <[email protected]> Control: fixed -1 5.1.5-1
Hi, PowerDNS Security Advisory 2026-13 (CVE-2026-73206) was published on 2026-10-21 [0]. A crafted DNS packet using compression pointers can drive up resource usage while decompressing names and cause a denial of service (CVSS 3.1 score 7.5, multi-vendor issue). Upstream released 4.9.18 with the fix on the same day [1]. In Debian, unstable and forky are fixed since 5.1.5-1 (2026-10-21). trixie still ships pdns 4.9.17-0+deb13u1, which the security tracker lists as vulnerable [2]. The debian/trixie branch on Salsa has not been touched since the 4.9.17-0+deb13u1 upload. We run pdns-server from trixie on amd64 in production (containers based on debian:trixie-slim, authoritative server with the lmdb and tinydns backends). Is a trixie-security update to 4.9.18 planned, as was done for 4. 9.15, 4.9.16 and 4.9.17? If a fix for trixie is not planned, a short note would be appreciated so that we can switch to the upstream repository instead. Thanks for maintaining the package. [0] https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-13.html [1] https://doc.powerdns.com/authoritative/changelog/4.9.html [2] https://security-tracker.debian.org/tracker/CVE-2026-73206 -- System Information: Debian Release: trixie Architecture: amd64 (x86_64) Versions of packages pdns-server depends on: ii adduser 3.152 ii libboost-program-options1.83.0 1.83.0-4.2 ii libc6 2.41-12+deb13u4 ii libcurl4t64 8.14.1-2+deb13u7 ii libgcc-s1 14.2.0-19 ii libluajit-5.1-2 2.1.0+openresty20250117-2 ii libp11-kit0 0.25.5-3 ii libsodium23 1.0.18-1+deb13u1 ii libsqlite3-0 3.46.1- 7+deb13u2 ii libssl3t64 3.5.7-1~deb13u3 ii libstdc++6 14.2.0-19 ii libsystemd0 257.13-1~deb13u1 Versions of packages pdns-server recommends: pn pdns-backend-bind <none> Versions of packages pdns-server suggests: ii pdns-backend-lmdb [pdns-backend] 4.9.17-0+deb13u1 ii pdns-backend-tinydns [pdns-backend] 4.9.17-0+deb13u1 -- no debconf information -- Noah Feldt, Mittwald (mittwald.de) Sent from my private address; work contact: [email protected]
publickey - [email protected] - 0x9B02BBB4.asc
Description: application/pgp-keys
signature.asc
Description: OpenPGP digital signature
