ISC Knowledgebase

BIND 9 Software Vulnerability Matrix

Wed, 21 Oct 2026 12:46:39 GMT

The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in supported versions of BIND. Vulnerabilities are identified by their CVE ID: Common Vulnerabilities and Exposures. This page was previously called the "BIND 9 Security Vulnerability Matrix". Using this matrix Each row with a CVE ID gives the version(s) that fix that problem. Determining vulnerability To determine if/how a given version is vulnerable: Find the column heading for the corresponding branch (9.X versi ...

Security Matrices for Obsolete BIND Branches

Wed, 21 Oct 2026 12:42:34 GMT

The vulnerability matrix for each obsolete branch of BIND is kept available for historical reference. For currently supported releases, see the BIND 9 Software Vulnerability Matrix instead. SECURITY WARNING Obsolete versions of BIND are all known to be vulnerable. ISC strongly recommends upgrading to a current version as soon as practical. The obsolete matrices will not be updated to reflect new vulnerabilities. You must assume you are vulnerable if you are running an obsolete version. For ...

BIND 9 Software Vulnerability Matrix - 9.18

Wed, 21 Oct 2026 12:42:24 GMT

SECURITY WARNING BIND 9.18 is obsolete. Obsolete versions of BIND are all known to be vulnerable. ISC strongly recommends upgrading to a current version as soon as practical. The obsolete matrices will not be updated to reflect new vulnerabilities. You must assume you are vulnerable if you are running an obsolete version. The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in version 9.18 of BIND during that branch's support life. Vulnerabilities are identified ...

List of BIND Security Advisories

Wed, 21 Oct 2026 12:40:48 GMT

Introduction This is a complete list of all BIND security advisories, both current and historical. Advisories apply only to particular versions of BIND, and this list makes no attempt to differentiate. For information on which versions are vulnerable, see the BIND 9 Software Vulnerability Matrix instead. Advisories are listed by date, most recent first. The publication date is the date of formal public disclosure. In this table, publication dates prior to 2022 may not be entirely accurate; ...

CVE-2026-97313: Specific RPZ configurations and query patterns may result in an unexpected exit

Wed, 21 Oct 2026 12:31:06 GMT

CVE: CVE-2026-97313 Title: Specific RPZ configurations and query patterns may result in an unexpected exit Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.16.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive q ...

CVE-2026-96888: named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

Wed, 21 Oct 2026 12:31:01 GMT

CVE: CVE-2026-96888 Title: Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.16.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.16.8-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization stric ...

CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory

Wed, 21 Oct 2026 12:30:55 GMT

CVE: CVE-2026-94300 Title: Concurrent GSS-TSIG messages corrupt memory Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP messa ...

CVE-2026-19630: Amplified resource exhaustion in inbound message processing

Wed, 21 Oct 2026 12:30:50 GMT

CVE: CVE-2026-19630 Title: Amplified resource exhaustion in inbound message processing Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no l ...

ISC Software Defect and Vulnerability Disclosure Policy

Mon, 19 Oct 2026 13:13:49 GMT

Private notes Please don't edit this article. If you see something that needs to be changed or added, tell Vicky and she will update it. Thank you! At ISC, we follow a published policy in determining whether and how to disclose defects discovered in our software products. No Bounties We are working for the interests of the greater Internet, and we hope you are too. ISC does not offer bug bounties(1). If you think you have found a bug in any ISC software, we encourage you to report it responsib ...

ISC's Software Support Policy and Version Numbering

Mon, 19 Oct 2026 13:05:05 GMT

Private notes Please don't edit this article - if you see something that needs to be fixed or changed, just let Vicky know and she will edit it. Thank you! The purpose of this article is to help users determine how long a given ISC release is likely to be supported. This information is useful when deciding when to schedule a migration, or in some cases, to help determine which version to migrate to when updating. This is a rough guide, not a guarantee, and release dates are approximate. For th ...

Upgrading Stork

Thu, 15 Oct 2026 15:39:36 GMT

Each Stork release includes both major pieces of the Stork architecture: Stork server and Stork agent. This brings the problem of the order of deployed components to be upgraded. There is no one single correct approach, as there may be deployment specific factors involved. As such, this article discusses several strategies. Overall, it is not recommended to mix different server and agent versions. Tip: Before upgrading, check the Stork Known Issues to see if anything affects you. Approach 1: Bot ...

How can I disable IPv6 recursive queries on my resolver?

Thu, 15 Oct 2026 11:38:10 GMT

On some networks, IPv6 is used internally, but is not supported by the link to the rest of the Internet. This degrades resolver performance due to named attempting to use IPv6 transport to send queries that can never be answered. BIND resolvers query other authoritative DNS servers in order to provide query responses to client queries. During recursive resolution, they will 'learn' the names and addresses of other servers, both IPv4 and IPv6. To prevent your server from using the learned IPv6 ...

--with-tuning=large - about using this build-time option

Thu, 15 Oct 2026 11:35:22 GMT

In BIND 9.10 (and earlier in the stable preview edition) we added a built-time option --with-tuning=large. This option allows operators to tune BIND for better performance in high-memory machines, by setting various constants and defaults to values more appropriate in such usage. Note that except for the MAXSOCKETS control (which can be set with "named -S") these settings are only available at compile time. Note also, that running a binary that has been built with --with-tuning=large may not hel ...

Stork Quickstart guide

Wed, 14 Oct 2026 12:18:38 GMT

Introduction Installing Stork can seem somewhat confusing at first. The purpose of this quickstart guide is to layout the installation process in steps grouped by package manager or OS. Choose your OS/package manager from the table of contents on the right hand side to jump directly to the section that will cover the installation on your system. Stork Agent Since the Stork Agent may need to be installed more than once on disparate systems (example: to monitor BIND and Kea installations which ...

DNSSEC validation - how can I tell if my server is doing it?

Sat, 10 Oct 2026 15:50:35 GMT

System administrators sometimes need a quick answer to the question "Is my DNS server doing DNSSEC validation or not?" Usually this is because they've just received notification of a BIND security advisory and aren't sure if it is applicable to their production environment or not. DNSSEC validation is performed on servers that are providing answers to client queries that have been obtained from other servers. Typically these servers will be configured to provide recursive services. BIND servers ...

Operational Notification: Domain with apex CNAME and unsigned delegation fails to resolve

Wed, 07 Oct 2026 17:10:05 GMT

Title: Operational Notification: Domain with apex CNAME and unsigned delegation fails to resolve Document Version: 1.0 Posting date: 7 October 2026 Canonical URL: https://kb.isc.org/docs/apex-cname-unsigned-delegation Program impacted: BIND Versions affected: BIND 9.20.26 to 9.20.29 Description: A BIND resolver may fail to resolve records within a child zone when all of the following are true: The child zone is delegated from a DNSSEC-signed parent zone The child zone is itself not DNSSEC-sig ...

BIND statement nxdomain-redirect

Wed, 07 Oct 2026 13:21:51 GMT

Name nxdomain-redirect Syntax nxdomain-redirect ; Blocks options, view Default value(s) None Introduced Date: 2016-03-25 BIND version: 9.11.0a1 Deprecated Still current as of 2026-10-07, but it will be deprecated in a future release. Removed N/A Description This option causes a resolver to append to the query name, if the first attempt to find an answer for the QNAME itself results in an NXDOMAIN response. BIND will then try to resolve the new QNAME and give that answer to t ...

Operational Notification: ISC DHCP OMAPI interface memory usage attack

Thu, 01 Oct 2026 15:25:13 GMT

Title: Operational Notification: ISC DHCP OMAPI interface memory usage attack Document Version: 1.2 Posting date: 1st October 2026 Canonical URL: https://kb.isc.org/docs/isc-dhcp-omapi-interface-memory-usage-attack Program impacted: ISC DHCP Versions affected: ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 4.4.0 -> 4.4.3. ISC DHCP is EOL All branches of ISC DHCP are beyond their End-of-Life (EOL) and are no longer supported by ISC. ISC DHCP users are encouraged to migrate to its successor, Kea. It is ...

Kea and the 767 bytes limit in MySQL

Thu, 01 Oct 2026 13:08:34 GMT

There are reports of problems showing up when MySQL is used with Kea under certain conditons. After preparing the MySQL database and running: $ kea-admin db-init mysql One of the following errors pops up: ERROR 1071 (42000) at line 805: Specified key was too long; max key length is 767 bytes or ERROR 1709 (HY000) at line 805: Index column size too large. The maximum column size is 767 bytes. These both refer to the same CREATE TABLE statement. CREATE TABLE IF NOT EXISTS dhcp4_server ( id BI ...

ISC DHCP 4.1 Manual Pages - omapi

Thu, 01 Oct 2026 12:32:14 GMT

omapi NAME OMAPI - Object Management Application Programming Interface DESCRIPTION OMAPI is an programming layer designed for controlling remote applications, and for querying them for their state. It is currently used by the ISC DHCP server and this outline addresses the parts of OMAPI appropriate to the clients of DHCP server. It does this by also describing the use of a thin API layered on top of OMAPI called ´dhcpctl´ OMAPI uses TCP/IP as the transport for server communication, and securit ...