mastodon 4.7.3ISC.org maintains and publishes the BIND 9 DNS software, the Kea DHCP server, and the Stork graphical management interface. ISC also operates the F-Root system for the benefit of the Internet.
When the European Commission approached us about funding a bug bounty for BIND 9, we were impressed with the proposal. We have a policy against bug bounties (because we were frustrated with people wasting our time), but under this proposal, the YesWeHack team would do initial triage, and use their expertise to minimize the 'slop' reports. This is a game-changer for a small development team.
The bounty program is active, and we are looking for our first valid report.
I just posted a blog, it is 100% nicer and more restrained than our development team would have posted. Read between the lines, people.... ;-)
https://www.isc.org/blogs/2026-04-16-How-to-report-a-vulnerability/
ISC is aware of an issue in the liburcu library which causes a memory leak on some platforms. BIND 9.20 and later use this library, and experience the leak on affected platforms.
Older versions of BIND do not use this library and are not affected.
Linux platforms are not affected.
FreeBSD and OpenBSD *are affected*. A preliminary analysis by ISC suggests that NetBSD and Mac OS X may be immune; however, as of this writing, that is not confirmed with upstream sources.
Kea 3.1.9, a development release of ISC's DHCP implementation, is published today.
The software is available from the ISC download page at https://www.isc.org/download/#Kea.
Source tarballs and packages are available from our Cloudsmith repositories at https://cloudsmith.io/~isc/repos/kea-dev/groups/ for the development version.
Development versions are not suitable for production use.
Thank you for using ISC’s software.
The July 2026 maintenance releases of BIND 9 are live.
In addition to bug fixes and feature improvements, these releases also contain fixes for security vulnerabilities:
https://kb.isc.org/docs/cve-2026-10723
https://kb.isc.org/docs/cve-2026-10822
https://kb.isc.org/docs/cve-2026-11331
https://kb.isc.org/docs/cve-2026-11605
https://kb.isc.org/docs/cve-2026-11622
https://kb.isc.org/docs/cve-2026-11721
https://kb.isc.org/docs/cve-2026-12617
https://kb.isc.org/docs/cve-2026-13204
https://kb.isc.org/docs/cve-2026-13321
Software and release notes at https://isc.org/download
If you run BIND, you may wonder what kinds of improvements you'll see when upgrading from one version to another. Occasionally we like to publish benchmark test results to help with those decisions.
We've just posted a blog on BIND 9.20 resolver performance compared to 9.18. tl;dr: under mid- to heavy traffic loads, 9.20 has even lower latency than 9.18, particularly while starting up.
Read more about our performance benchmarking at https://www.isc.org/blogs/2026-03-05-bind-resolver-performance/
Thanks for using ISC's software!
Prepare for more frequent security updates for BIND9 (and most open source, probably) for the remainder of this year, due to the impact of LLM code analysis.
It may not be as bad as it sounds, we are finding that many of these formal errors are not terribly serious after all, but still, plan for frequent updates.
Our May 2026 maintenance releases of BIND 9 are available at https://isc.org/download : 9.18.49 and 9.20.23 (stable) and 9.21.22 (development). Packages and container images provided by ISC will be updated later today.
In addition to bug fixes and feature improvements, these releases also contain fixes for security vulnerabilities:
- https://kb.isc.org/docs/cve-2026-3039
- https://kb.isc.org/docs/cve-2026-3592
- https://kb.isc.org/docs/cve-2026-3593
- https://kb.isc.org/docs/cve-2026-5946
- https://kb.isc.org/docs/cve-2026-5947
- https://kb.isc.org/docs/cve-2026-5950
ISC is pleased to announce the releases of Kea 3.0.4, a maintenance release on a stable branch, and 3.3.0, a development release.
The software can be downloaded from https://www.isc.org/download/#Kea
Please read the release notes before upgrading.
Thank you for using ISC's software!
ISC, CZ.NIC, NLnet Labs, and NetDEF have jointly submitted a response to the European Open Digital Ecosystem Strategy, and we invite everyone to read it.
RE: @patrickbenkoetter@troet.cafe
We're very fond of you guys too, and thank you for working on this!! It was fun to meet up in Edinburgh and see the POC.
"This is also a good reminder that we rely so very much on the Internet Archive for many projects of the time."
Nominet helped to fund a refresh of our 9-year-old performance test bed for BIND 9. We found their funding program to be easy to apply for, with quick response (so no more waiting months and months for an answer). Highly recommend to DNS developers.
ISC is excited to announce the release of Kea 3.2.0! This is a major release and includes a long list of bug fixes, feature improvements, and build changes.
For an overview of the main updates available, please read our blog post at https://www.isc.org/blogs/kea-3-2/ .
Please READ THE RELEASE NOTES thoroughly before upgrading to Kea 3.2.0. The software and release notes can be downloaded from our website at https://www.isc.org/download/#Kea .
Thank you for using Kea DHCP!
ISC mourns the loss of one of our board members, Dr. David "Dave" Farber: https://www.isc.org/blogs/david-farber-memoriam/
Our June 2026 maintenance releases of BIND 9 are posted. Packages provided by ISC will be updated later today.
- Stable:
- 9.18.50 - https://downloads.isc.org/isc/bind9/9.18.50/
- 9.20.24 - https://downloads.isc.org/isc/bind9/9.20.24/
- Development:
- 9.21.23 - https://downloads.isc.org/isc/bind9/9.21.23/
BIND 9.18.50 will be the last release in the 9.18 series.
We will be changing the version in the bind-esv repositories from 9.18 to 9.20 before our July release. Check the version in the repository before updating.
Tomorrow's BIND release will be the LAST RELEASE for BIND 9.18. It is time to upgrade to a newer version. Also, we will be updating our old stable "bind-esv" package repos to serve BIND 9.20 instead of BIND 9.18 with our July release. https://www.isc.org/blogs/2026-06-10-bind9-18-eol/
Fewer organizations host their own DNS these days, but for those of you still doing it, you can feel some smug satisfaction that at least you are not vulnerable to the ‘underminr’ tactic.
ADAMNetworks has published a web site on their discovery that abusers can use CDN hosting environments to circumvent DNS filtering. (https://underminr.ai/technical/)
The authors provide a tool to identify if a domain is vulnerable (https://underminr.ai), but self-hosting is one sure way to avoid this problem.
Our April 2026 maintenance releases of BIND 9 are available.
- Current supported stable branches:
- 9.18.48 - https://downloads.isc.org/isc/bind9/9.18.48/
- 9.20.22 - https://downloads.isc.org/isc/bind9/9.20.22/
- Experimental development branch:
- 9.21.21 - https://downloads.isc.org/isc/bind9/9.21.21/
For more information, release notes, and other release formats, please visit the ISC software download page: https://www.isc.org/download/
Thanks for using ISC's software!
(Finally) RFC9915, DHCPv6bis, is an Internet Standard.
Here's a photo of ISC's Petr Špaček giving his "Brace for Upgrades - Plural" talk at #RIPE92 last week, as well as a slide from his presentation.
The bottom line: streamline your deployment processes, because you're going to need to update often to keep up with the onslaught of AI-discovered vulnerabilities.
(And if you're a researcher, please don't just submit slop reports! ISC and the other open source vendors are doing our best to triage everything, but we need your help.)
Enjoy a couple of pictures of Ondřej Surý speaking at #RIPE92 ! Were you there for his talk? What did you think?
ISC's Director of DNS Engineering, Ondřej Surý, spoke at last week's #RIPE92 conference on "DNS, Transitive Trust and How Many is Many." It was an interactive presentation with lots of interesting insights and discussion.
Watch the recording or read the transcript at https://ripe92.ripe.net/programme/meeting-plan/sessions/98/ATVK7Z/#video
New maintenance releases of BIND 9 are available and can be downloaded at https://isc.org/download/#BIND. The new stable branches are 9.18.46 and 9.20.20, and the new development branch is 9.21.19.
Packages and container images provided by ISC will be updated later today.
Please see the release notes for important changes and details.
Thank you for using ISC's software!
ISC is pleased to announce the results of code audits for our Kea DHCP and Stork graphical management software projects! With support from @ostifofficial@fosstodon.org and funded by the ICANN Grant Program, these audits found a handful of issues that our teams have already been able to address, and gave us valuable insights for future development.
Read more about the audits at https://www.isc.org/blogs/2026-two-code-audits/
Our January 2026 maintenance releases of BIND 9 are available and can be downloaded from the links below. Packages and container images provided by ISC will be updated later today.
In addition to bug fixes and feature improvements, these releases also contain fixes for a security vulnerability. More information can be found in the following Security Advisory:
https://kb.isc.org/docs/cve-2025-13878
Download software and release notes at: https://www.isc.org/download/
ISC is proud to be one of the first projects to receive funding from the Nominet DNS Fund! They are generously supporting the purchase of some new test equipment for our BIND 9 performance monitoring lab, and we are grateful for their support.
Read more about all the funding recipients at https://nominet.uk/blog/investing-in-the-internets-essential-technology-inside-the-first-nominet-dns-fund-projects/ !
ISC is pleased to announce the releases of Kea DHCP 3.1.6 (development branch) and Stork 2.4.0, a new stable branch.
The new Stork includes lots of changes, including direct API support for Kea; improved DNS monitoring support for both BIND 9 and PowerDNS; sortable tables, many security improvements; an updated user interface; build, test, and documentation upgrades; and many bug fixes.
Software and release notes available at https://www.isc.org/download/
Thank you for using ISC’s software!
Today I learned that someone has recently built a Webmin module for Kea -
lots of screen shots in the pull request. - [ ] https://github.com/webmin/webmin/pull/2736
ISC is pleased to announce the releases of Kea 2.6.5 and 3.0.3 (stable) and 3.1.7 (development).
Both stable versions address a vulnerability in Kea DHCP; see our published advisory at https://kb.isc.org/docs/cve-2026-3608 . Kea 3.1.7 is not susceptible to this CVE, but development versions are not suitable for production use.
The releases are available from the ISC download page at https://www.isc.org/download/#Kea.
Thank you for using ISC’s software!
Our DHCP development team was very busy in 2025! Find out more about the progress on our Kea and Stork software at https://www.isc.org/blogs/2025-dhcp-report/
Internet Systems Consortium is pleased to announce the release of Stork 2.4.1, a maintenance version of the current stable branch of the Stork GUI management system for our Kea DHCP server. There are no new features, but a number of bug fixes.
Release notes for the this version are available at
https://downloads.isc.org/isc/stork/2.4.1/Stork-2.4.1-ReleaseNotes.txt
Source tarballs and packages for the new Stork release are available at https://cloudsmith.io/~isc/repos/stork/groups/ .
The Stork release can also be retrieved at https://www.isc.org/download/#Stork.
Our February 2026 maintenance releases of BIND 9 are available for versions 9.18.45, 9.20.19, and 9.21.18. Packages and container images provided by ISC will be updated later today.
Download source code and release notes at https://www.isc.org/download/
---
As a reminder, BIND’s supported platforms are listed in the ARM (https://bind9.readthedocs.io/en/stable/chapter2.html#supported-platforms) and in this knowledgebase article (https://kb.isc.org/docs/supported-platforms).
Thank you for using ISC's software!
ISC's March 2026 maintenance releases of BIND 9 are available at https://isc.org/download : stable branches 9.18.47 and 9.20.21, and development branch 9.21.20.
Packages and container images provided by ISC will be updated later today.
In addition to bug fixes and feature improvements, these releases also contain fixes for security vulnerabilities:
https://kb.isc.org/docs/cve-2026-1519
https://kb.isc.org/docs/cve-2026-3104
https://kb.isc.org/docs/cve-2026-3119
https://kb.isc.org/docs/cve-2026-3591
Thanks for using ISC's software!
For those interested in US Internet policy, this panel discussion from the 2026 State of the Net conference is very interesting. The panel is looking back on the last 30 years of broadband internet regulations and asking, what went well, what did the 1996 Telecom Act get right, and what did they miss?
You can get a quick text summary too, but it is kind of calming to slow down and watch the talking heads.
The EC has just published more guidance on the CRA (Cyber Resilience Act). Find out whether you or your organization are a 'manufacturer' or a 'steward' or neither of these, under the CRA.
There are now explicit details surrounding the non-profit exemption, and lots of 'example situations' that illustrate what responsibility category an open source software publisher falls into. This is a very helpful update!
@rootwyrm@weird.autos Is this a trick question? They're already there! 😃
The first *stable* version on Alpine 3.23 will be Kea 3.2.0, which will be released soon.
