<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">BIND users,<br><br>Plan for more frequent BIND security updates, at least for the remainder of 2026. <div><br></div><div>Large language models (LLMs) are making it much easier to find software vulnerabilities in open source, lowering the bar for researchers and bad actors alike, and causing a temporary flood of vulnerability reports to us, and to many open source projects. We are currently triaging vulnerability reports, both from external reporters and our own LLM analysis, at a rate that exceeds 10X the historic levels. (<a href="https://www.isc.org/blogs/2026-04-16-How-to-report-a-vulnerability/">https://www.isc.org/blogs/2026-04-16-How-to-report-a-vulnerability/</a>)<br><br>To manage the avalanche of reports, we are making a few changes to the BIND release process and vulnerability handling. We plan to re-evaluate these changes at the end of 2026. <br>- We are deferring the release of the next stable branch, BIND 9.22, until at least the end of 2026.<br>- We will end maintenance for 9.18 and 9.18-S as previously scheduled, at the end of June 2026. <div>I have updated the ‘roadmap’ document in our knowledgebase: <a href="https://kb.isc.org/docs/aa-00896">https://kb.isc.org/docs/aa-00896</a> to reflect this change. <br><br><b>Users who are currently running 9.18 or 9.18-S should make plans to update to 9.20 as soon as possible, because we will be focusing our efforts on fixing vulnerabilities in the 9.20 and 9.21 branches. </b><br><br>BIND users should plan for frequent security updates for the rest of the year. Although we have had an informal practice of limiting ourselves to a single security release per quarter, to relieve the pressure on operators to update frequently, the situation now demands some changes.<br>- For the foreseeable future, users should expect security fixes in every monthly BIND maintenance release.<br>- We will not be able to invest extra effort to determine exactly which minor release introduced an issue; users should update to the latest maintenance version on their branch.<br>- We are now releasing reproduction tests at the time of vulnerability publication, because these are mostly already discoverable via LLM. <br><br>We may also begin issuing CVEs for more medium-severity issues, such as those that score in the CVSS 5 - 7 range. Our policy is to issue Early Vulnerability Notices (EVNs) only for CVSS scores of 7 or higher, which is not changing. We may not always backport fixes for medium-severity CVEs, depending on the specific case. We welcome feedback on whether issuing CVEs for lower-severity problems would conflict with any of your internal policies.<br><br>These things, however, will not change:<br><br>- We will continue to aggressively pursue and fix reported vulnerabilities in BIND 9. We develop these fixes in a private repository and merge them into the public repository right before release, to protect our users from early disclosure. <br>- We will continue to assign CVE numbers for all issues that score over 7.0 on the CVSS scale. <br>- We will continue to maintain BIND 9.20 and 9.20-S, and to develop 9.21. We have not paused new feature development, although we are prioritizing addressing the vulnerabilities. <br><br>We plan to reevaluate this situation in Q4 2026, and we hope that we will be able to return to our normal release cadence in Q1 2027. <br><br>We appreciate your understanding and flexibility as we work to keep BIND safe and reliable for our users.<br><br>Regards,<br><br>Vicky Risk<br><div><br></div><div><br></div></div></div></body></html>