If you suspect you have found a vulnerability in BIND 9, Kea DHCP, Stork, or ISC DHCP, ISC encourages you to take one or more of the following actions, as appropriate:
Reporting a suspected security vulnerability in our software
- Open a confidential BIND 9 GitLab issue - for vulnerabilities in BIND 9
- Open a confidential DNS GitLab Work item - for DNS vulnerabilities that impact more than one open source DNS implementation (including CZNIC’s Knot and Knot Resolver, NLNET Lab’s Unbound and NSD, PowerDNS’s PDNS, PDNS Recursor, and DNSDIST)
- Open a confidential Kea GitLab issue - for Kea DHCP-related vulnerabilities
- Open a confidential Stork GitLab issue - - for Stork-related vulnerabilities
- Open a confidential ISC DHCP GitLab issue - - for ISC-DHCP-related vulnerabilities (NB this project is EOL, we will not be issuing security releases)
We strongly prefer that you open an issue in the respective ISC GitLab repo because this makes it possible to keep you, the reporter, updated as we triage and remediate the issue. We use GitLab to organize all our development work and having some issues conducted via email is simply not workable. We are experiencing a historic increase in software vulnerability reports due to code analysis by LLMs and we appreciate your willingness to moderate the coordination overhead by using ISC’s GitLab for your vulnerability reports.
- security-officer@isc.org - for any other security issues*
* If this is an unusually sensitive security issue we ask that you please encrypt your communications to the security-officer@isc.org address using the ISC Security Officer public key found on our PGP Key page. Our OpenPGP keys are also available from our FTP site. PGP encryption is not usually necessary when reporting a suspected software vulnerability.
Learn more about ISC’s Software Defect and Vulnerability Disclosure Policy.
Reporting a software bug that is NOT a security vulnerability
If you are not sure whether your bug is in fact a software vulnerability, open it as a confidential issue, and we will remove the confidentiality flag when triaging. There is a small checkbox in the lower left area of the new issue display, below the issue description. Check that to ensure your issue is not open to the public before it is triaged.
- Please report bugs in BIND 9 by opening an issue in our BIND GitLab.
- Please report bugs in Kea at our Kea GitLab.
- Please report bugs in Stork in our Stork GitLab.
- Please report ISC DHCP bugs at our ISC DHCP GitLab.
Ensuring you are not running software with a known vulnerability
For a listing of vulnerabilities in BIND 9, please see the BIND 9 Vulnerability Matrix in ISC’s Knowledgebase. Kea and ISC DHCP CVEs are also available in our Knowledgebase.
To ensure that you are notified of any new discovered vulnerabilities, you should become an ISC support subscriber, which entitles you to early notification of vulnerabilities via a secure, private support queue.
You can also follow ISC vulnerability notices by subscribing to one of our community mailing lists. Please subscribe to the BIND-announce, Kea-announce, and/or DHCP-announce list(s), as appropriate.
ISC uses the CVSS calculator, a program of first.org and NIST, to determine the severity of potential security issues. We invite users to read more about our CVSS Scoring Guidelines in our Knowledgebase.