Hi,

PowerDNS Security Advisory 2026-13 (CVE-2026-73206) was published on
2026-10-21 [0]. A crafted DNS packet using compression pointers can
drive up resource usage while decompressing names and cause a denial
of service (CVSS 3.1 score 7.5, multi-vendor issue).

Upstream released 4.9.18 with the fix on the same day [1]. In Debian,
unstable and forky are fixed since 5.1.5-1 (2026-10-21).

trixie still ships pdns 4.9.17-0+deb13u1, which the security tracker
lists as vulnerable [2]. The debian/trixie branch on Salsa has not been
touched since the 4.9.17-0+deb13u1 upload.

We run pdns-server from trixie on amd64 in production (containers
based on debian:trixie-slim, authoritative server with the lmdb and
tinydns backends). Is a trixie-security update to 4.9.18 planned, as
was done for 4.
9.15, 4.9.16 and 4.9.17? If a fix for trixie is not
planned, a short note would be appreciated so that we can switch to
the upstream repository instead.

Thanks for maintaining the package.

[0] https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2026-13.html
[1] https://doc.powerdns.com/authoritative/changelog/4.9.html
[2] https://security-tracker.debian.org/tracker/CVE-2026-73206