Version in base suite: 5.2.11-0+deb13u1 Version in overlay suite: 5.2.12-0+deb13u1 Base version: pdns-recursor_5.2.12-0+deb13u1 Target version: pdns-recursor_5.2.13-0+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/p/pdns-recursor/pdns-recursor_5.2.12-0+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/p/pdns-recursor/pdns-recursor_5.2.13-0+deb13u1.dsc configure | 20 ++++----- configure.ac | 2 debian/changelog | 7 +++ dnsname.cc | 13 ++++-- dnssecinfra.cc | 4 + effective_tld_names.dat | 104 +++++++++++++++++++++++------------------------- iputils.cc | 5 ++ iputils.hh | 5 ++ pdns_recursor.1 | 2 pubsuffix.cc | 49 +++++++++++++--------- rec_control.1 | 2 test-dnsname_cc.cc | 11 +++++ test-iputils_hh.cc | 23 ++++++++++ 13 files changed, 157 insertions(+), 90 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpw9e_vxd3/pdns-recursor_5.2.12-0+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpw9e_vxd3/pdns-recursor_5.2.13-0+deb13u1.dsc: no acceptable signature found diff -Nru pdns-recursor-5.2.12/configure pdns-recursor-5.2.13/configure --- pdns-recursor-5.2.12/configure 2026-07-07 09:30:24.000000000 +0000 +++ pdns-recursor-5.2.13/configure 2026-08-05 12:01:44.000000000 +0000 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for pdns-recursor 5.2.12. +# Generated by GNU Autoconf 2.71 for pdns-recursor 5.2.13. # # # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, @@ -618,8 +618,8 @@ # Identity of this package. PACKAGE_NAME='pdns-recursor' PACKAGE_TARNAME='pdns-recursor' -PACKAGE_VERSION='5.2.12' -PACKAGE_STRING='pdns-recursor 5.2.12' +PACKAGE_VERSION='5.2.13' +PACKAGE_STRING='pdns-recursor 5.2.13' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1588,7 +1588,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures pdns-recursor 5.2.12 to adapt to many kinds of systems. +\`configure' configures pdns-recursor 5.2.13 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1659,7 +1659,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of pdns-recursor 5.2.12:";; + short | recursive ) echo "Configuration of pdns-recursor 5.2.13:";; esac cat <<\_ACEOF @@ -1859,7 +1859,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -pdns-recursor configure 5.2.12 +pdns-recursor configure 5.2.13 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -2348,7 +2348,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by pdns-recursor $as_me 5.2.12, which was +It was created by pdns-recursor $as_me 5.2.13, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -3844,7 +3844,7 @@ # Define the identity of the package. PACKAGE='pdns-recursor' - VERSION='5.2.12' + VERSION='5.2.13' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -31013,7 +31013,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by pdns-recursor $as_me 5.2.12, which was +This file was extended by pdns-recursor $as_me 5.2.13, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -31081,7 +31081,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -pdns-recursor config.status 5.2.12 +pdns-recursor config.status 5.2.13 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff -Nru pdns-recursor-5.2.12/configure.ac pdns-recursor-5.2.13/configure.ac --- pdns-recursor-5.2.12/configure.ac 2026-07-07 09:30:15.000000000 +0000 +++ pdns-recursor-5.2.13/configure.ac 2026-08-05 12:01:36.000000000 +0000 @@ -1,6 +1,6 @@ AC_PREREQ([2.69]) -AC_INIT([pdns-recursor], [5.2.12]) +AC_INIT([pdns-recursor], [5.2.13]) AC_CONFIG_AUX_DIR([build-aux]) AM_INIT_AUTOMAKE([foreign dist-bzip2 no-dist-gzip tar-ustar -Wno-portability subdir-objects parallel-tests 1.11]) AM_SILENT_RULES([yes]) diff -Nru pdns-recursor-5.2.12/debian/changelog pdns-recursor-5.2.13/debian/changelog --- pdns-recursor-5.2.12/debian/changelog 2026-07-21 13:41:43.000000000 +0000 +++ pdns-recursor-5.2.13/debian/changelog 2026-08-07 08:18:12.000000000 +0000 @@ -1,3 +1,10 @@ +pdns-recursor (5.2.13-0+deb13u1) trixie-security; urgency=medium + + * New upstream version 5.2.13, fixing security issue + CVE-2026-52682 + + -- Chris Hofstaedtler Fri, 07 Aug 2026 10:18:12 +0200 + pdns-recursor (5.2.12-0+deb13u1) trixie-security; urgency=medium * New upstream version 5.2.12, fixing security issues diff -Nru pdns-recursor-5.2.12/dnsname.cc pdns-recursor-5.2.13/dnsname.cc --- pdns-recursor-5.2.12/dnsname.cc 2026-07-07 09:28:56.000000000 +0000 +++ pdns-recursor-5.2.13/dnsname.cc 2026-08-05 12:00:38.000000000 +0000 @@ -127,6 +127,8 @@ size_t DNSName::parsePacketUncompressed(const pdns::views::UnsignedCharView& view, size_t pos, bool uncompress) { const size_t initialPos = pos; + auto existingSize = d_storage.size(); + const size_t neededSizeForFinalLabel = /* final empty label length */ (existingSize == 0 ? 1U : 0U); size_t totalLength = 0; unsigned char labellen = 0; @@ -151,24 +153,27 @@ throw std::range_error("Found an invalid label length in qname (only one of the first two bits is set)"); } checkLabelLength(labellen); - // reserve one byte for the label length - if (totalLength + labellen > s_maxDNSNameLength - 1) { + + // reserve one byte for the label length, plus one byte for the final empty label if we were empty before + if ((existingSize + totalLength + labellen + 1U + neededSizeForFinalLabel) > s_maxDNSNameLength) { throw std::range_error("name too long to append"); } if (pos + labellen >= view.size()) { throw std::range_error("Found an invalid label length in qname"); } pos += labellen; - totalLength += 1 + labellen; + totalLength += 1U + labellen; } while (pos < view.size()); if (totalLength != 0) { - auto existingSize = d_storage.size(); if (existingSize > 0) { // remove the last label count, we are about to override it */ --existingSize; } + if ((existingSize + totalLength + 1U) > s_maxDNSNameLength) { + throw std::range_error("name too long to append"); + } d_storage.reserve(existingSize + totalLength + 1); d_storage.resize(existingSize + totalLength); memcpy(&d_storage.at(existingSize), &view.at(initialPos), totalLength); diff -Nru pdns-recursor-5.2.12/dnssecinfra.cc pdns-recursor-5.2.13/dnssecinfra.cc --- pdns-recursor-5.2.12/dnssecinfra.cc 2026-07-07 09:28:56.000000000 +0000 +++ pdns-recursor-5.2.13/dnssecinfra.cc 2026-08-05 12:00:38.000000000 +0000 @@ -604,7 +604,9 @@ { try { unsigned int algo = digestToAlgorithmNumber(digest); - return isAlgorithmSupported(algo); + const makers_t& makers = getMakers(); + auto iter = makers.find(algo); + return iter != makers.cend(); } catch(const std::exception& e) { return false; diff -Nru pdns-recursor-5.2.12/effective_tld_names.dat pdns-recursor-5.2.13/effective_tld_names.dat --- pdns-recursor-5.2.12/effective_tld_names.dat 2026-07-07 09:31:25.000000000 +0000 +++ pdns-recursor-5.2.13/effective_tld_names.dat 2026-08-05 12:02:34.000000000 +0000 @@ -5,8 +5,8 @@ // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat, // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported. -// VERSION: 2026-07-06_09-10-11_UTC -// COMMIT: 5ae2220ad86eab1364821329ff58d28828bddb19 +// VERSION: 2026-07-25_14-20-03_UTC +// COMMIT: e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/. @@ -1176,12 +1176,16 @@ // Confirmed by registry 2024-11-20 ge com.ge +cyb.ge edu.ge gov.ge +llc.ge net.ge +online.ge org.ge pvt.ge school.ge +tnx.ge // gf : https://www.iana.org/domains/root/db/gf.html gf @@ -1464,11 +1468,14 @@ // Please note, that nic.in is not an official eTLD, but used by most // government institutions. // Confirmed by Gaurav Kansal 2025-11-06 +// Added aero.in, alumni.in, school.in and ub.in by Gaurav Kansal 2026-06-25 in 5g.in 6g.in ac.in +aero.in ai.in +alumni.in am.in bank.in bihar.in @@ -1503,8 +1510,10 @@ post.in pro.in res.in +school.in travel.in tv.in +ub.in uk.in up.in us.in @@ -1622,7 +1631,6 @@ trentin-südtirol.it trentin-sued-tirol.it trentin-suedtirol.it -trentino.it trentino-a-adige.it trentino-aadige.it trentino-alto-adige.it @@ -1643,7 +1651,6 @@ trentinostirol.it trentinosud-tirol.it trentinosüd-tirol.it -trentinosudtirol.it trentinosüdtirol.it trentinosued-tirol.it trentinosuedtirol.it @@ -1659,7 +1666,6 @@ val-d-aosta.it val-daosta.it vald-aosta.it -valdaosta.it valle-aosta.it valle-d-aosta.it valle-daosta.it @@ -1696,7 +1702,6 @@ aoste.it ap.it aq.it -aquila.it ar.it arezzo.it ascoli-piceno.it @@ -1920,6 +1925,9 @@ sp.it sr.it ss.it +su.it +sud-sardegna.it +sudsardegna.it südtirol.it suedtirol.it sv.it @@ -1940,6 +1948,7 @@ traniandriabarletta.it tranibarlettaandria.it trapani.it +trentino.it trento.it treviso.it trieste.it @@ -1958,6 +1967,7 @@ venezia.it venice.it verbania.it +verbano-cusio-ossola.it vercelli.it verona.it vi.it @@ -4336,14 +4346,18 @@ fhs.no folkebibl.no fylkesbibl.no +gielda.no +herad.no idrett.no +kommune.no museum.no priv.no +suohkan.no +tjielte.no +uenorge.no vgs.no // Norid category second-level domains managed by parties other than Norid : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-d/ dep.no -herad.no -kommune.no mil.no stat.no // Norid geographical second level domains : https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-b/ @@ -4484,7 +4498,7 @@ askvoll.no asnes.no åsnes.no -audnedaln.no +audnedal.no aukra.no aure.no aurland.no @@ -4595,7 +4609,6 @@ fosnes.no fræna.no frana.no -frei.no frogn.no froland.no frosta.no @@ -4646,6 +4659,7 @@ halsa.no hamar.no hamaroy.no +hamarøy.no hammarfeasta.no hámmárfeasta.no hammerfest.no @@ -4700,6 +4714,7 @@ kárášjohka.no karasjok.no karlsoy.no +karlsøy.no karmoy.no karmøy.no kautokeino.no @@ -4888,6 +4903,7 @@ rana.no randaberg.no rauma.no +re.no rendalen.no rennebu.no rennesoy.no @@ -5045,6 +5061,7 @@ tysvar.no ullensaker.no ullensvang.no +ulstein.no ulvik.no unjarga.no unjárga.no @@ -5800,7 +5817,6 @@ // tj : http://www.nic.tj/policy.html tj -ac.tj biz.tj co.tj com.tj @@ -6822,7 +6838,7 @@ // newGTLDs -// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-06-13T16:12:40Z +// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-07-24T16:40:16Z // This list is auto-generated, don't edit it manually. // aaa : American Automobile Association, Inc. // https://www.iana.org/domains/root/db/aaa.html @@ -8888,7 +8904,7 @@ // https://www.iana.org/domains/root/db/kuokgroup.html kuokgroup -// kyoto : Academic Institution: Kyoto Jyoho Gakuen +// kyoto : Academic Institution: The University of Informatics // https://www.iana.org/domains/root/db/kyoto.html kyoto @@ -10716,6 +10732,10 @@ // https://www.iana.org/domains/root/db/weatherchannel.html weatherchannel +// web : VeriSign, Inc. +// https://www.iana.org/domains/root/db/web.html +web + // webcam : dot Webcam Limited // https://www.iana.org/domains/root/db/webcam.html webcam @@ -11284,10 +11304,6 @@ a2hosted.com cpserver.com -// Acorn Labs : https://acorn.io -// Submitted by Craig Jellick -*.on-acorn.io - // ActiveTrail : https://www.activetrail.biz/ // Submitted by Ofer Kalaora activetrail.biz @@ -12561,12 +12577,6 @@ // Submitted by Klara Mall *.bwcloud-os-instance.de -// Bytemark Hosting : https://www.bytemark.co.uk -// Submitted by Paul Cammish -uk0.bigv.io -dh.bytemark.co.uk -vm.bytemark.co.uk - // Caf.js Labs LLC : https://www.cafjs.com // Submitted by Antonio Lain cafjs.com @@ -12751,6 +12761,12 @@ // Submitted by Gavin Brown co.com +// Code For Host Inc Ltd : https://codeforhost.com +// Submitted by Mehedi Hasan +sch.ac +dev.cv +store.cv + // Codeberg e. V. : https://codeberg.org // Submitted by Moritz Marquardt codeberg.page @@ -12820,10 +12836,6 @@ // Submitted by Ales Krajnik realm.cz -// Cryptonomic : https://cryptonomic.net/ -// Submitted by Andrew Cady -*.cryptonomic.net - // cyber_Folks S.A. : https://cyberfolks.pl // Submitted by Bartlomiej Kida cfolks.pl @@ -12906,11 +12918,6 @@ // Submitted by Peter Thomassen dedyn.io -// Deta : https://www.deta.sh/ -// Submitted by Aavash Shrestha -deta.app -deta.dev - // Deuxfleurs : https://deuxfleurs.fr // Submitted by Aeddis Desauw deuxfleurs.eu @@ -13490,10 +13497,6 @@ staging.expo.app on.staging.expo.app -// Fabrica Technologies, Inc. : https://www.fabrica.dev/ -// Submitted by Eric Jiang -onfabrica.com - // fachschaften.org: https://fachschaften.org/ // Submitted by Felix Schäfer fspages.org @@ -14225,6 +14228,12 @@ // Submitted by Matthew Hardeman ipifony.net +// IPv64.net : https://ipv64.net/ +// Submitted by Dennis Schröder +home64.de +ipv64.de +ipv64.net + // ir.md : https://nic.ir.md // Submitted by Ali Soizi ir.md @@ -15196,6 +15205,10 @@ *.platformsh.site *.tst.site +// Playcode : https://playcode.io +// Submitted by Ruslan Ianberdin +playcode.site + // Pley AB : https://www.pley.com/ // Submitted by Henning Pohl pley.games @@ -15240,10 +15253,6 @@ // Submitted by yumenewa dev.project-study.com -// Protonet GmbH : http://protonet.io -// Submitted by Martin Meier -protonet.io - // PSL Sandbox : https://github.com/groundcat/PSL-Sandbox // Submitted by groundcat platter-app.dev @@ -15425,10 +15434,6 @@ resindevice.io devices.resinstaging.io -// RethinkDB : https://www.rethinkdb.com/ -// Submitted by Chris Kastorff -hzc.io - // Rico Developments Limited : https://adimo.co // Submitted by Colin Brown adimo.co.uk @@ -15630,9 +15635,10 @@ schokokeks.net // Scottish Government : https://www.gov.scot -// Submitted by Martin Ellis +// Submitted by Martin Ellis gov.scot service.gov.scot +mygov.scot // Scry Security : http://www.scrysec.com // Submitted by Shante Adam @@ -15850,10 +15856,6 @@ musician.io novecore.site -// Standard Library : https://stdlib.com -// Submitted by Jacob Lee -api.stdlib.com - // statichost.eu : https://www.statichost.eu // Submitted by Eric Selin statichost.page @@ -15880,10 +15882,6 @@ // Submitted by Tony Schirmer storebase.store -// Storj Labs Inc. : https://storj.io/ -// Submitted by Philip Hutchins -storj.farm - // Strapi : https://strapi.io/ // Submitted by Florent Baldino strapiapp.com diff -Nru pdns-recursor-5.2.12/iputils.cc pdns-recursor-5.2.13/iputils.cc --- pdns-recursor-5.2.12/iputils.cc 2026-07-07 09:28:56.000000000 +0000 +++ pdns-recursor-5.2.13/iputils.cc 2026-08-05 12:00:38.000000000 +0000 @@ -365,6 +365,11 @@ memset(start + len - tozero / 8, 0, tozero / 8); // blot out the whole bytes on the right NOLINT(cppcoreguidelines-pro-bounds-pointer-arithmetic) auto bitsleft = tozero % 8; // 2 bits left to clear + if (bitsleft == 0) { + // the memset() above cleared whole bytes only, and for 0 bits the byte we + // would look at is the one before the address + return; + } // a b c d, to truncate to 22 bits, we just zeroed 'd' and need to zero 2 bits from c // so and by '11111100', which is ~((1<<2)-1) = ~3 diff -Nru pdns-recursor-5.2.12/iputils.hh pdns-recursor-5.2.13/iputils.hh --- pdns-recursor-5.2.12/iputils.hh 2026-07-07 09:28:56.000000000 +0000 +++ pdns-recursor-5.2.13/iputils.hh 2026-08-05 12:00:38.000000000 +0000 @@ -649,6 +649,11 @@ } // still here, now match remaining bits uint8_t bits = d_bits % 8; + if (bits == 0) { + // no partial byte left to match, and lhs[index] would be one past the + // address for a /128 + return true; + } auto mask = static_cast(~(0xFF >> bits)); return ((lhs[index]) == (rhs[index] & mask)); diff -Nru pdns-recursor-5.2.12/pdns_recursor.1 pdns-recursor-5.2.13/pdns_recursor.1 --- pdns-recursor-5.2.12/pdns_recursor.1 2026-07-07 09:31:25.000000000 +0000 +++ pdns-recursor-5.2.13/pdns_recursor.1 2026-08-05 12:02:34.000000000 +0000 @@ -27,7 +27,7 @@ .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. -.TH "PDNS_RECURSOR" "1" "Jul 07, 2026" "" "PowerDNS Recursor" +.TH "PDNS_RECURSOR" "1" "Aug 05, 2026" "" "PowerDNS Recursor" .SH NAME pdns_recursor \- The PowerDNS Recursor binary .SH SYNOPSIS diff -Nru pdns-recursor-5.2.12/pubsuffix.cc pdns-recursor-5.2.13/pubsuffix.cc --- pdns-recursor-5.2.12/pubsuffix.cc 2026-07-07 09:31:25.000000000 +0000 +++ pdns-recursor-5.2.13/pubsuffix.cc 2026-08-05 12:02:34.000000000 +0000 @@ -822,12 +822,16 @@ "edu.gd", "gov.gd", "com.ge", +"cyb.ge", "edu.ge", "gov.ge", +"llc.ge", "net.ge", +"online.ge", "org.ge", "pvt.ge", "school.ge", +"tnx.ge", "co.gg", "net.gg", "org.gg", @@ -986,7 +990,9 @@ "5g.in", "6g.in", "ac.in", +"aero.in", "ai.in", +"alumni.in", "am.in", "bank.in", "bihar.in", @@ -1021,8 +1027,10 @@ "post.in", "pro.in", "res.in", +"school.in", "travel.in", "tv.in", +"ub.in", "uk.in", "up.in", "us.in", @@ -1106,7 +1114,6 @@ "trentin-sudtirol.it", "trentin-sued-tirol.it", "trentin-suedtirol.it", -"trentino.it", "trentino-a-adige.it", "trentino-aadige.it", "trentino-alto-adige.it", @@ -1124,7 +1131,6 @@ "trentinos-tirol.it", "trentinostirol.it", "trentinosud-tirol.it", -"trentinosudtirol.it", "trentinosued-tirol.it", "trentinosuedtirol.it", "trentinsud-tirol.it", @@ -1137,7 +1143,6 @@ "val-d-aosta.it", "val-daosta.it", "vald-aosta.it", -"valdaosta.it", "valle-aosta.it", "valle-d-aosta.it", "valle-daosta.it", @@ -1169,7 +1174,6 @@ "aoste.it", "ap.it", "aq.it", -"aquila.it", "ar.it", "arezzo.it", "ascoli-piceno.it", @@ -1386,6 +1390,9 @@ "sp.it", "sr.it", "ss.it", +"su.it", +"sud-sardegna.it", +"sudsardegna.it", "suedtirol.it", "sv.it", "ta.it", @@ -1405,6 +1412,7 @@ "traniandriabarletta.it", "tranibarlettaandria.it", "trapani.it", +"trentino.it", "trento.it", "treviso.it", "trieste.it", @@ -1423,6 +1431,7 @@ "venezia.it", "venice.it", "verbania.it", +"verbano-cusio-ossola.it", "vercelli.it", "verona.it", "vi.it", @@ -3510,13 +3519,17 @@ "fhs.no", "folkebibl.no", "fylkesbibl.no", +"gielda.no", +"herad.no", "idrett.no", +"kommune.no", "museum.no", "priv.no", +"suohkan.no", +"tjielte.no", +"uenorge.no", "vgs.no", "dep.no", -"herad.no", -"kommune.no", "mil.no", "stat.no", "aa.no", @@ -3624,7 +3637,7 @@ "askoy.no", "askvoll.no", "asnes.no", -"audnedaln.no", +"audnedal.no", "aukra.no", "aure.no", "aurland.no", @@ -3710,7 +3723,6 @@ "forsand.no", "fosnes.no", "frana.no", -"frei.no", "frogn.no", "froland.no", "frosta.no", @@ -3932,6 +3944,7 @@ "rana.no", "randaberg.no", "rauma.no", +"re.no", "rendalen.no", "rennebu.no", "rennesoy.no", @@ -4051,6 +4064,7 @@ "tysvar.no", "ullensaker.no", "ullensvang.no", +"ulstein.no", "ulvik.no", "unjarga.no", "utsira.no", @@ -4589,7 +4603,6 @@ "mi.th", "net.th", "or.th", -"ac.tj", "biz.tj", "co.tj", "com.tj", @@ -6047,9 +6060,6 @@ "radio.fm", "cdn.bubble.io", "bubbleapps.io", -"uk0.bigv.io", -"dh.bytemark.co.uk", -"vm.bytemark.co.uk", "cafjs.com", "canva-apps.cn", "my.canvasite.cn", @@ -6159,6 +6169,9 @@ "cnpy.gdn", "co.ca", "co.com", +"sch.ac", +"dev.cv", +"store.cv", "codeberg.page", "csb.app", "preview.csb.app", @@ -6232,8 +6245,6 @@ "piebox.site", "deployagent.space", "dedyn.io", -"deta.app", -"deta.dev", "deuxfleurs.eu", "deuxfleurs.page", "d6.ply.gg", @@ -6690,7 +6701,6 @@ "on.expo.app", "staging.expo.app", "on.staging.expo.app", -"onfabrica.com", "fspages.org", "ru.net", "adygeya.ru", @@ -7114,6 +7124,9 @@ "app-ionos.space", "iopsys.se", "ipifony.net", +"home64.de", +"ipv64.de", +"ipv64.net", "ir.md", "is-a-good.dev", "iservschule.de", @@ -7650,6 +7663,7 @@ "ent.platform.sh", "eu.platform.sh", "us.platform.sh", +"playcode.site", "pley.games", "onporter.run", "co.bn", @@ -7667,7 +7681,6 @@ "mmv.kr", "vki.kr", "dev.project-study.com", -"protonet.io", "platter-app.dev", "e.id", "chirurgiens-dentistes-en-france.fr", @@ -7746,7 +7759,6 @@ "repl.run", "resindevice.io", "devices.resinstaging.io", -"hzc.io", "adimo.co.uk", "itcouldbewor.se", "aus.basketball", @@ -7863,6 +7875,7 @@ "schokokeks.net", "gov.scot", "service.gov.scot", +"mygov.scot", "scrysec.com", "client.scrypted.io", "firewall-gateway.com", @@ -7959,7 +7972,6 @@ "indevs.in", "musician.io", "novecore.site", -"api.stdlib.com", "statichost.page", "feedback.ac", "forms.ac", @@ -7974,7 +7986,6 @@ "ipfs.storacha.link", "ipfs.w3s.link", "storebase.store", -"storj.farm", "strapiapp.com", "media.strapiapp.com", "vps-host.net", diff -Nru pdns-recursor-5.2.12/rec_control.1 pdns-recursor-5.2.13/rec_control.1 --- pdns-recursor-5.2.12/rec_control.1 2026-07-07 09:31:25.000000000 +0000 +++ pdns-recursor-5.2.13/rec_control.1 2026-08-05 12:02:34.000000000 +0000 @@ -27,7 +27,7 @@ .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. -.TH "REC_CONTROL" "1" "Jul 07, 2026" "" "PowerDNS Recursor" +.TH "REC_CONTROL" "1" "Aug 05, 2026" "" "PowerDNS Recursor" .SH NAME rec_control \- Command line tool to control a running Recursor .SH SYNOPSIS diff -Nru pdns-recursor-5.2.12/test-dnsname_cc.cc pdns-recursor-5.2.13/test-dnsname_cc.cc --- pdns-recursor-5.2.12/test-dnsname_cc.cc 2026-07-07 09:28:56.000000000 +0000 +++ pdns-recursor-5.2.13/test-dnsname_cc.cc 2026-08-05 12:00:38.000000000 +0000 @@ -842,6 +842,17 @@ BOOST_CHECK_THROW(DNSName dn(name.c_str(), name.size(), 0, true), std::range_error); } +BOOST_AUTO_TEST_CASE(test_name_length_too_long_from_wire) { + + string name("\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x05""stats""\x05""stats""\x02""fr""\x00", 256); + BOOST_CHECK_THROW(DNSName(name.c_str(), name.size(), 0, true), std::range_error); +} + +BOOST_AUTO_TEST_CASE(test_name_length_too_long_from_wire_compressed) { + string name("\x0a""wwwwwwwwww""\x00""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x03""www""\x05""stats""\x05""stats""\x02""fr""\xc0""\x00", 265); + BOOST_CHECK_THROW(DNSName(name.c_str(), name.size(), 12, true), std::range_error); +} + BOOST_AUTO_TEST_CASE(test_compression) { // Compression test string name("\x03""com\x00""\x07""example\xc0""\x00""\x03""www\xc0""\x05", 21); diff -Nru pdns-recursor-5.2.12/test-iputils_hh.cc pdns-recursor-5.2.13/test-iputils_hh.cc --- pdns-recursor-5.2.12/test-iputils_hh.cc 2026-07-07 09:28:56.000000000 +0000 +++ pdns-recursor-5.2.13/test-iputils_hh.cc 2026-08-05 12:00:38.000000000 +0000 @@ -144,6 +144,19 @@ ca6.truncate(8); BOOST_CHECK_EQUAL(ca6.toString(), "2000::"); + /* truncating to 0 bits leaves no partial byte, so nothing before the address + may be touched */ + ca4 = ComboAddress("130.161.252.29", 53); + ca4.truncate(0); + BOOST_CHECK_EQUAL(ca4.toString(), "0.0.0.0"); + BOOST_CHECK_EQUAL(ca4.sin4.sin_port, htons(53)); + + ca6 = ComboAddress("2001:888:2000:1d::2", 53); + ca6.sin6.sin6_flowinfo = htonl(0x0badcafe); + ca6.truncate(0); + BOOST_CHECK_EQUAL(ca6.toString(), "::"); + BOOST_CHECK_EQUAL(ca6.sin6.sin6_flowinfo, htonl(0x0badcafe)); + orig=ca6=ComboAddress("2001:888:2000:1d::2"); for(int n=128; n; --n) { @@ -218,6 +231,16 @@ BOOST_CHECK(nmp6.match("fe80::92fb:a6ff:fe4a:51da")); BOOST_CHECK(!nmp6.match("fe81::92fb:a6ff:fe4a:51db")); + /* a /128 leaves no partial byte to compare, so the scope id sitting right + after the address must not be taken into account */ + ComboAddress scoped("fe80::92fb:a6ff:fe4a:51da"); + scoped.sin6.sin6_scope_id = 1; + Netmask nmscoped(scoped); + BOOST_CHECK_EQUAL(nmscoped.getBits(), 128); + BOOST_CHECK(nmscoped.match(scoped)); + BOOST_CHECK(nmscoped.match("fe80::92fb:a6ff:fe4a:51da")); + BOOST_CHECK(!nmscoped.match("fe80::92fb:a6ff:fe4a:51db")); + Netmask all("0.0.0.0/0"); BOOST_CHECK(all.match(local) && all.match(remote));