New information for the decision between pdns-recursor 4.8.8 (the bridge in vyos-build #1329) and a newer series: PowerDNS published Security Advisory 2026-12 on 21 October (https://blog.powerdns.com/2026/10/21/powerdns-security-advisory-2026-12-for-powerdns-recursor, details in https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-12.html). Seven CVEs, fixed in 5.3.12 and 5.4.8. The advisory names up to 5.3.11 and 5.4.7 as affected and says nothing about 4.x, which is end of life and not checked.

Ok I will test these today. And will share all my findings with you

@saadinnocent909 I could reproduce the reset problem, and it is not caused by the test build. It is a crash that is already in the current rolling image.

PR https://github.com/accel-ppp/accel-ppp-ng/pull/44
@saadinnocent909 If you want test I can give you a new package.

I do understand that. I will update you today, after thorough testing Insha
Allah

@saadinnocent909 thank you for testing, good to hear that the counters work now and that the usage shows up in the interim updates.

Im guessing the comment from closing my task of results from Lynis scanning 3 years ago still remains?

In some cases, a container requires specific services (like mDNS) to be initiated, not just between containers. I hope this general case can also be addressed. Thank you.

I did some testing with patch. Counters started working and I started to
get usage in freeradius interim accounting updates. But I also noticed
another issue if I kick a user using reset command all users are
disconnected. Tomorrow I will share stats as well and will do some more
testing. Idle timeout and session timout I will check these as well
tomorrow

added PR implementing option 2

Same bug, with a second cost beyond CPU/log noise, plus a tested workaround.

Confirmed issue and resolution using option 1 on 2026.10.20-0026-rolling release (manually edited geoip.py).

Tomorrow I will give it a try and update you.

PR https://github.com/vyos/vyos-build/pull/1331 but the fix for T9493 must be merged before. I can't create teh PR in the moment cause the PR number limit.

I reproduced this and tested Kea 3.2.1 on a rolling VM (2026.10.16-0024-rolling).

@saadinnocent909 there is no ISO or rolling image with the fix, the PR (https://github.com/accel-ppp/accel-ppp-ng/pull/42) is still in review. Here is a test build of the three changed files that you can put on an existing rolling system:

I reproduced this on a rolling VM and have a fix. I can not open a pull request for it: GitHub limits me to 5 open pull requests in vyos/vyos-1x and all 5 are in use. The commit is on my fork, anyone can take it as it is or I open the PR as soon as a slot is free:

can you share me patched iso or lates rolling release includes the PR ?

Two additions: how serious the open CVEs are, and a simpler way to get to 5.x through T7557.

I prepared this as a draft PR so that someone else can continue if needed: https://github.com/vyos/vyos-1x/pull/5585

I implemented option one with PR https://github.com/vyos/vyos-build/pull/1329

Summary of what I found, and a question on the direction.

@Viacheslaw I will take care. Can you assign it to me?

https://github.com/vyos/vyos-1x/pull/5584

I think we are OK to use even pdns-recursor-5.4.6
Be sure that it fixes the issue, and feel free to add a PR with package build, you can find an example of build HAProxy

I can test

@saadinnocent909 can you test my PR in your environment?

Merged:

• vyos-1x: https://github.com/vyos/vyos-1x/pull/5529
• docs: https://github.com/vyos/vyos-documentation/pull/2328

Thanks for doing the work to replicate the issue.

I was testing vyos as BNG for my network especially with vpp. But I faced same issue. I hope issue will be resolved soon

Reproduced on a VM (rolling, kernel 6.18.55-vyos) with the steps from the description:

I reproduced this on a VM with rolling (PowerDNS Recursor 4.8.8, pdns-recursor 4.8.8-1+deb12u1) and the cause is in the recursor, not in vyos-hostsd or the addNTA lines. The addNTA lines only set DNSSEC negative trust anchors, they do not take part in resolving names.

https://github.com/vyos/vyos-1x/pull/5583

PR https://github.com/vyos/vyos-1x/pull/5581

We do not have the iso flavor

vyos_bld@fae3ff9bbe25:/vyos/work/tmp/vyos-build$ sudo make iso
./build-vyos-image iso
I: Checking if packages required for VyOS image build are installed
I: using build flavors directory data/build-flavors
E: Build flavor "iso" does not exist!
make: *** [Makefile:39: iso] Error 1

I have created a PR for this
https://github.com/vyos/vyos-1x/pull/5561

@rherold

1. Same result: no stuck VLAN in any test, including 15 full-table bond rebuilds each. The PR defers the sync, because that also handles other VPP-side changes made during a resync, not only the MTU.