Dear Knot Resolver users, Knot Resolver 6.4.1 has been released! Security: - DNS-over-QUIC (DoQ) had severe issues, allowing even RCE   Many people reported (some of) these issues to us. - DNSSEC correctness issues, acting mainly through the aggressive cache:   * dealing with Labels field in RRSIGs being smaller than the signer's   * dealing with NSEC's next-name pointing outside of the zone Special thanks to Qifan Zhang from Palo Alto Networks. Improvements: - docker: upgrade to Debian 13 (!1856) - update IANA's certificate for root trust anchor bootstrapping (!1845) Bugfixes: - /local-data/addresses*: make multiple addresses work (#808, #954) - views: fix protocol-based matching for DoQ Full changelog: https://gitlab.nic.cz/knot/knot-resolver/raw/v6.4.1/NEWS Sources: https://knot-resolver.nic.cz/release/knot-resolver-6.4.1.tar.xz GPG signature: https://knot-resolver.nic.cz/release/knot-resolver-6.4.1.tar.xz.asc Documentation: https://www.knot-resolver.cz/documentation/v6.4.1/ -- Ales Mrazek PGP: 3057 EE9A 448F 362D 7420 5A77 9AB1 20DA 0A76 F6DE