- CVE-2026-42960: prevent cache poisoning via promiscuous additional-section records by marking glue only for NS RRsets in the authority section [ELSCVE-130594] - CVE-2026-42944: fix heap overflow and crash with multiple NSID and PADDING EDNS options by deduplicating options and adding bounds checks in attach_edns_record_max_msg_sz [ELSCVE-130649] - CVE-2026-41292: cap parsed EDNS options at MAX_PARSED_EDNS_OPTIONS (100) to prevent DoS via long option lists [ELSCVE-130636] - CVE-2026-42959: fix out-of-bounds write in val_fill_reply by indexing the destination array with chase->ns_numrrsets instead of orig->ns_numrrsets [ELSCVE-130615] - CVE-2026-40622: prevent ghost-domain TTL extension by clamping newd->ttl to cached->ttl in the higher-trust branch of need_to_update_rrset [ELSCVE-129354]