- CVE-2026-42960: in scrub_normalize(), mark additional-section glue as allowed only for NS rrsets in the authority section, so address records can no longer be cached as a side effect of a delegation response - CVE-2026-80225: bound the number of pipelined queries drained from one TCP/DoT connection per event-loop visit to NUM_TCP_PER_SELECT and defer the remainder through a zero-delay timer, so a single connection can no longer monopolise a worker event loop - CVE-2026-85501: add the val-validation-attempts and val-hash-attempts limits (default 32 each) to bound DNSSEC signature and hash work per validation, and require only the answer and authority sections to be secure (reply_an_ns_rrsets_secure), so the additional section is no longer validated