A maintenance release with a Go toolchain update that includes disclosed CVE fixes, an ACL-check bypass correction, and changes to operator-visible defaults. It also adds features and corrects defects across the DNS server.
Action needed (1)
securityhigh
Go 1.security fixes26. 6 The release is built with
Go 1., including fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.26. 6
Check if affected (3)
security
plugin/aclautopath ACL checksApplies if you use
plugin/aclandautopath.breaking
plugin/forwarddefault connection attemptsApplies if you use
plugin/forward.breaking
plugin/hostsunsupported-type fallthroughApplies if you use
plugin/hosts.