https://kb.isc.org/docs Introduction This is a complete list of all Stork security advisories, both current and historical. Advisories apply only to particular versions of Stork, and this list makes no attempt to differentiate. Consult the individual advisories to determine which Stork version(s) the advisory applies to. Advisories are listed by date, most recent first. The release date is the date of public disclosure. Advisories CVE ID Title Released CVE-2025-8696 DoS attack against the Stork UI from an unauthen ... Thu, 05 Nov 2026 14:20:49 GMT Stork > Security Advisories https://kb.isc.org/docs/stork-advisories https://kb.isc.org/docs/stork-advisories 2026-10-27 Greg There are a few articles on rate limiting in general, which could do with a tidy up. This one might be enhanced using information from the following tickets and other references. There's too much to copy/paste here: RT15132 RT14977 WI664 MR2519 The Recursive Client Rate Limiting feature was introduced in BIND 9.11 (and was also made available as a build-time option in BIND 9.9.8 and 9.10.3) This feature is intended to optimize recursive server behavior in favor of good client q ... Tue, 03 Nov 2026 13:34:07 GMT BIND 9 > Control and protection within BIND > Minimization and limiting https://kb.isc.org/docs/aa-01304 https://kb.isc.org/docs/aa-01304 Recursive Client Rate limiting provides tuning controls intended to optimize recursive server behavior in favor of good client queries, whilst at the same time limiting the impact of bad client queries (e.g. queries which cannot be resolved, or which take too long to resolve) on local recursive server resource use. This article was created to answer some FAQs about this feature, derived from real questions that have been posed to ISC. The main resources on Recursive Client Rate limiting are: Re ... Tue, 03 Nov 2026 13:28:44 GMT BIND 9 > Control and protection within BIND > Minimization and limiting https://kb.isc.org/docs/aa-01316 https://kb.isc.org/docs/aa-01316 Suggested edits by Doug 2026-11-02 The warning box at the very bottom about lease caching should be integrated into the article further up, maybe in the configuring section, as people are unlikely to make it past the giant wall of JSON that is the full configurations The links to RFCs should point to RFC Editor, which recently got a very nice overhaul and is a much nicer site to use these days. Introduction New Kea users often want to setup redundancy. Many may have previously used ISC DHCP, w ... Mon, 02 Nov 2026 19:56:33 GMT Kea DHCP > Configuring Kea https://kb.isc.org/docs/kea-ha-quickstart-guide https://kb.isc.org/docs/kea-ha-quickstart-guide Private notes Please don't edit this article - if you see something that needs to be fixed or changed, just let Vicky know and she will edit it. Thank you! The purpose of this article is to help users determine how long a given ISC release is likely to be supported. This information is useful when deciding when to schedule a migration, or in some cases, to help determine which version to migrate to when updating. This is a rough guide, not a guarantee, and release dates are approximate. For th ... Wed, 28 Oct 2026 12:20:29 GMT About ISC https://kb.isc.org/docs/aa-00896 https://kb.isc.org/docs/aa-00896 Private notes Should this document be marked as depricated, the use of "configure --with-randomdev" has not been available for some time I believe randomness is now generated by uv_random() The server requires a source of entropy -- i.e., random numbers -- to perform certain cryptographic operations for DNSSEC or to generate keys for TSIG. These messages indicate that you have no source of entropy. On systems that use /dev/random or an equivalent device to provide access to the kernel's random ... Tue, 27 Oct 2026 16:57:30 GMT BIND 9 > Host platform issues > Randomness and entropy https://kb.isc.org/docs/aa-00309 https://kb.isc.org/docs/aa-00309 This is a living document based on the CVSS 3.1 specification document and user guide, with specific examples for DNS and BIND. We use these guidelines in scoring vulnerabilities, which are then disclosed according to our ISC Software Defect and Security Vulnerability Disclosure Policy. Please also refer to the BIND Administrative Reference Manual, which provides further background on what is considered to be a security vulnerability in BIND. Sources: FIRST CVSS User Guide CVSS v3.1 Specificat ... Mon, 26 Oct 2026 09:40:36 GMT BIND 9 > Security Advisories https://kb.isc.org/docs/isc-cvss-scoring-guidelines https://kb.isc.org/docs/isc-cvss-scoring-guidelines The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in supported versions of BIND. Vulnerabilities are identified by their CVE ID: Common Vulnerabilities and Exposures. This page was previously called the "BIND 9 Security Vulnerability Matrix". Using this matrix Each row with a CVE ID gives the version(s) that fix that problem. Determining vulnerability To determine if/how a given version is vulnerable: Find the column heading for the corresponding branch (9.X versi ... Wed, 21 Oct 2026 12:46:39 GMT BIND 9 > Security Advisories https://kb.isc.org/docs/aa-00913 https://kb.isc.org/docs/aa-00913 The vulnerability matrix for each obsolete branch of BIND is kept available for historical reference. For currently supported releases, see the BIND 9 Software Vulnerability Matrix instead. SECURITY WARNING Obsolete versions of BIND are all known to be vulnerable. ISC strongly recommends upgrading to a current version as soon as practical. The obsolete matrices will not be updated to reflect new vulnerabilities. You must assume you are vulnerable if you are running an obsolete version. For ... Wed, 21 Oct 2026 12:42:34 GMT BIND 9 > Security Advisories > Obsolete Matrices https://kb.isc.org/docs/obsolete-bind-vulnerability-lists https://kb.isc.org/docs/obsolete-bind-vulnerability-lists SECURITY WARNING BIND 9.18 is obsolete. Obsolete versions of BIND are all known to be vulnerable. ISC strongly recommends upgrading to a current version as soon as practical. The obsolete matrices will not be updated to reflect new vulnerabilities. You must assume you are vulnerable if you are running an obsolete version. The BIND 9 Software Vulnerability Matrix details known security vulnerabilities in version 9.18 of BIND during that branch's support life. Vulnerabilities are identified ... Wed, 21 Oct 2026 12:42:24 GMT BIND 9 > Security Advisories > Obsolete Matrices https://kb.isc.org/docs/bind-9-software-vulnerability-matrix-9-18 https://kb.isc.org/docs/bind-9-software-vulnerability-matrix-9-18 Introduction This is a complete list of all BIND security advisories, both current and historical. Advisories apply only to particular versions of BIND, and this list makes no attempt to differentiate. For information on which versions are vulnerable, see the BIND 9 Software Vulnerability Matrix instead. Advisories are listed by date, most recent first. The publication date is the date of formal public disclosure. In this table, publication dates prior to 2022 may not be entirely accurate; ... Wed, 21 Oct 2026 12:40:48 GMT BIND 9 > Security Advisories https://kb.isc.org/docs/all-bind-advisories https://kb.isc.org/docs/all-bind-advisories CVE: CVE-2026-97313 Title: Specific RPZ configurations and query patterns may result in an unexpected exit Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.16.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive q ... Wed, 21 Oct 2026 12:31:06 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-97313 https://kb.isc.org/docs/cve-2026-97313 CVE: CVE-2026-96888 Title: Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.16.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.16.8-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization stric ... Wed, 21 Oct 2026 12:31:01 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-96888 https://kb.isc.org/docs/cve-2026-96888 CVE: CVE-2026-94300 Title: Concurrent GSS-TSIG messages corrupt memory Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP messa ... Wed, 21 Oct 2026 12:30:55 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-94300 https://kb.isc.org/docs/cve-2026-94300 CVE: CVE-2026-19630 Title: Amplified resource exhaustion in inbound message processing Document version: 2.0 Posting date: 21 October 2026 Program impacted: BIND 9 Versions affected: BIND 9.11.0 -> 9.18.50 9.20.0 -> 9.20.29 9.21.0 -> 9.21.26 BIND Supported Preview Edition 9.11.3-S1 -> 9.18.50-S1 9.20.9-S1 -> 9.20.29-S1 Severity: High Exploitable: Remotely Description: In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no l ... Wed, 21 Oct 2026 12:30:50 GMT BIND 9 > Security Advisories > 2026 https://kb.isc.org/docs/cve-2026-19630 https://kb.isc.org/docs/cve-2026-19630 Private notes Please don't edit this article. If you see something that needs to be changed or added, tell Vicky and she will update it. Thank you! At ISC, we follow a published policy in determining whether and how to disclose defects discovered in our software products. No Bounties We are working for the interests of the greater Internet, and we hope you are too. ISC does not offer bug bounties(1). If you think you have found a bug in any ISC software, we encourage you to report it responsib ... Mon, 19 Oct 2026 13:13:49 GMT About ISC https://kb.isc.org/docs/aa-00861 https://kb.isc.org/docs/aa-00861 Each Stork release includes both major pieces of the Stork architecture: Stork server and Stork agent. This brings the problem of the order of deployed components to be upgraded. There is no one single correct approach, as there may be deployment specific factors involved. As such, this article discusses several strategies. Overall, it is not recommended to mix different server and agent versions. Tip: Before upgrading, check the Stork Known Issues to see if anything affects you. Approach 1: Bot ... Thu, 15 Oct 2026 15:39:36 GMT Stork https://kb.isc.org/docs/upgrading-stork https://kb.isc.org/docs/upgrading-stork On some networks, IPv6 is used internally, but is not supported by the link to the rest of the Internet. This degrades resolver performance due to named attempting to use IPv6 transport to send queries that can never be answered. BIND resolvers query other authoritative DNS servers in order to provide query responses to client queries. During recursive resolution, they will 'learn' the names and addresses of other servers, both IPv4 and IPv6. To prevent your server from using the learned IPv6 ... Thu, 15 Oct 2026 11:38:10 GMT BIND 9 > Networking and transports https://kb.isc.org/docs/aa-00206 https://kb.isc.org/docs/aa-00206 In BIND 9.10 (and earlier in the stable preview edition) we added a built-time option --with-tuning=large. This option allows operators to tune BIND for better performance in high-memory machines, by setting various constants and defaults to values more appropriate in such usage. Note that except for the MAXSOCKETS control (which can be set with "named -S") these settings are only available at compile time. Note also, that running a binary that has been built with --with-tuning=large may not hel ... Thu, 15 Oct 2026 11:35:22 GMT BIND 9 > Installation > Building from source https://kb.isc.org/docs/aa-01314 https://kb.isc.org/docs/aa-01314 Introduction Installing Stork can seem somewhat confusing at first. The purpose of this quickstart guide is to layout the installation process in steps grouped by package manager or OS. Choose your OS/package manager from the table of contents on the right hand side to jump directly to the section that will cover the installation on your system. Stork Agent Since the Stork Agent may need to be installed more than once on disparate systems (example: to monitor BIND and Kea installations which ... Wed, 14 Oct 2026 12:18:38 GMT Stork https://kb.isc.org/docs/stork-quickstart-guide https://kb.isc.org/docs/stork-quickstart-guide