https://kb.isc.org/docs The purpose of this article is to help users determine how long a given ISC release is likely to be supported. This information is useful when deciding when to schedule a migration, or in some cases, to help determine which version to migrate to when updating. This is a rough guide, not a guarantee, and release dates are approximate. For the most current information on the status of any particular software version, please refer to the software status listed on the downloads page. BIND 9 (updated ... Sat, 01 Aug 2026 11:32:57 GMT About ISC https://kb.isc.org/docs/aa-00896 https://kb.isc.org/docs/aa-00896 The following table shows the approximate dates when ISC officially ended engineering support for these Kea releases. Typically, a release is end of life when another major version is issued. EOL status means that the software development team is no longer testing, patching or issuing releases for that version. ISC Support will generally provide support for any version they are able to. However, versions without engineering support will not receive new fixes, nor will we be able to call on engin ... Fri, 31 Jul 2026 22:30:42 GMT Kea DHCP https://kb.isc.org/docs/kea-end-of-life-dates https://kb.isc.org/docs/kea-end-of-life-dates Title: Operational Notification: liburcu memory leak may impact BIND 9.20 on BSD Document Version: 1.0 Posting date: 29 July 2026 Canonical URL: https://kb.isc.org/docs/liburcu-leak Program impacted: BIND Versions affected: BIND 9.20.0 and later Description: ISC is aware of an issue in the liburcu library which causes a memory leak on some platforms. BIND 9.20 and later use this library, and experience the leak on affected platforms. Older versions of BIND do not use this library and are not ... Wed, 29 Jul 2026 14:18:40 GMT BIND 9 > Operational Notifications https://kb.isc.org/docs/liburcu-leak https://kb.isc.org/docs/liburcu-leak Introduction Kea's High Availability hook is the most popular solution for high availability operation. The Kea HA hook works by pairing Kea servers (a multi-node solution is also available), in either an active-active or active-passive collaboration scheme. In this way, the Kea servers can monitor each other and assume responsibility for answering on behalf of the other server in case of failure. It is also possible for multiple Kea servers to leverage the lease 'backend' feature to share a sin ... Wed, 22 Jul 2026 20:09:48 GMT Kea DHCP > Configuring Kea https://kb.isc.org/docs/kea-ha-strategies-comparison https://kb.isc.org/docs/kea-ha-strategies-comparison Introduction In some cases, administrators may want to configure Kea to use the "Shared Lease Database" High Availability method. This method has certain advantages when compared to the HA Hook. The advantages and disadvantages of each method are covered in the Kea HA Strategies Comparison document. In this document, the focus will be on configuring the Shared Lease Database method in Kea. Both DHCPv4 and DHCPv6 Please note that the Shared Lease Database is relevant to both DHCPv4 and DHCPv6 ... Wed, 22 Jul 2026 19:38:21 GMT Kea DHCP > Configuring Kea https://kb.isc.org/docs/kea-shared-lease-database-quickstart https://kb.isc.org/docs/kea-shared-lease-database-quickstart Introduction This is a complete list of all BIND security advisories, both current and historical. Advisories apply only to particular versions of BIND, and this list makes no attempt to differentiate. For information on which versions are vulnerable, see the BIND 9 Software Vulnerability Matrix instead. Advisories are listed by date, most recent first. The publication date is the date of formal public disclosure. In this table, publication dates prior to 2022 may not be entirely accurate; ... Wed, 22 Jul 2026 13:27:39 GMT BIND 9 > Security Advisories https://kb.isc.org/docs/all-bind-advisories https://kb.isc.org/docs/all-bind-advisories The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in supported versions of BIND. Vulnerabilities are identified by their CVE ID: Common Vulnerabilities and Exposures. This page was previously called the "BIND 9 Security Vulnerability Matrix". Using this matrix Each row with a CVE ID gives the version(s) that fix that problem. Determining vulnerability To determine if/how a given version is vulnerable: Find the column heading for the corresponding branch (9.X versi ... Wed, 22 Jul 2026 13:07:07 GMT BIND 9 > Security Advisories https://kb.isc.org/docs/aa-00913 https://kb.isc.org/docs/aa-00913 CVE: CVE-2026-11721 Title: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: High Exploitable: Remotely Description: It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels th ... Wed, 22 Jul 2026 12:40:04 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-11721 https://kb.isc.org/docs/cve-2026-11721 CVE: CVE-2026-11622 Title: Potential memory usage beyond configured limits Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: High Exploitable: Remotely Description: A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The ... Wed, 22 Jul 2026 12:36:35 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-11622 https://kb.isc.org/docs/cve-2026-11622 CVE: CVE-2026-10723 Title: Incorrect acceptance of NSEC3 records Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.18.0 -> 9.18.50 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: Medium Exploitable: Remotely Description: BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. Impact: An att ... Wed, 22 Jul 2026 12:32:43 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-10723 https://kb.isc.org/docs/cve-2026-10723 CVE: CVE-2026-13204 Title: Unexpected exit in certain situations with NSEC and NSEC3 both present Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: High Exploitable: Remotely Description: If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for ... Wed, 22 Jul 2026 12:29:10 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-13204 https://kb.isc.org/docs/cve-2026-13204 CVE: CVE-2026-12617 Title: Record ordering based unexpected exit with CNAME or DNAME Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.18.0 -> 9.18.50 9.20.0 -> 9.20.24 BIND Supported Preview Edition 9.18.11-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: High Exploitable: Remotely Description: The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Sp ... Wed, 22 Jul 2026 12:24:46 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-12617 https://kb.isc.org/docs/cve-2026-12617 CVE: CVE-2026-11605 Title: Unnecessary validation of DNSSEC signed records Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.20.9-S1 -> 9.20.24-S1 Severity: High Exploitable: Remotely Description: The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A quer ... Wed, 22 Jul 2026 12:20:21 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-11605 https://kb.isc.org/docs/cve-2026-11605 CVE: CVE-2026-11331 Title: Potential wildcard CNAME RPZ policy bypass Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.16.0 -> 9.18.50 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.16.8-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: High Exploitable: Remotely Description: An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLO ... Wed, 22 Jul 2026 12:16:54 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-11331 https://kb.isc.org/docs/cve-2026-11331 CVE: CVE-2026-13321 Title: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: High Exploitable: Remotely Description: The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Impact: ... Wed, 22 Jul 2026 12:11:45 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-13321 https://kb.isc.org/docs/cve-2026-13321 CVE: CVE-2026-10822 Title: Key Record using PRIVATEDNS algorithm may lead to unexpected exit Document version: 2.0 Posting date: 22 July 2026 Program impacted: BIND 9 Versions affected: BIND 9.18.0 -> 9.18.50 9.20.0 -> 9.20.24 9.21.0 -> 9.21.23 BIND Supported Preview Edition 9.18.11-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.24-S1 Severity: Medium Exploitable: Remotely Description: If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subseq ... Wed, 22 Jul 2026 12:06:31 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-10822 https://kb.isc.org/docs/cve-2026-10822 The BIND9-S edition is distributed to ISC Support Subscribers at the Silver level and above. A recent version of the Administrative Reference Manual is shared here, to facilitate understanding of what the -S Edition offers. If you are using the BIND9-S Edition, please instead consult the relevant version of the ARM, included in the distribution. The file below is an epub format archive of the ARM for BIND version 9.20.25-S1. Bv9ARM-3.epub Wed, 15 Jul 2026 14:30:08 GMT BIND 9 > Navigating BIND documentation https://kb.isc.org/docs/bind-920-s-edition-arm https://kb.isc.org/docs/bind-920-s-edition-arm Your browser does not support PDF.click here to download Tue, 30 Jun 2026 13:59:09 GMT About ISC > Support Subscriber Newsletter https://kb.isc.org/docs/isc-support-subscriber-news-q2-2026 https://kb.isc.org/docs/isc-support-subscriber-news-q2-2026 What is DLZ? DLZ (Dynamically Loadable Zones) is a contributed extension to BIND 9 that allows zone data to be retrieved directly from an external database. There is no required format or schema.  DLZ drivers exist for several different database backends including PostgreSQL, MySQL, and LDAP and can be written for any other. As of BIND 9.8, it is also possible to link some DLZ modules dynamically at runtime via the DLZ "dlopen" driver, which acts as a generic wrapper around a shared object that ... Mon, 29 Jun 2026 13:08:34 GMT BIND 9 > Zones > Dynamically generating zone contents https://kb.isc.org/docs/aa-00995 https://kb.isc.org/docs/aa-00995 Private notes Only visible to team accounts This table lists the major feature differences for different releases of Kea. A "✔︎" in the table below indicates that feature is present in that branch. When all currently supported versions of Kea have the feature, we remove the row (because there is no difference to highlight). See Release Notes for More Detailed Changes This list does not include many smaller changes, including changes in existing features or minor new features. For more detail, ... Wed, 24 Jun 2026 12:00:07 GMT Kea DHCP https://kb.isc.org/docs/aa-01615 https://kb.isc.org/docs/aa-01615