If you suspect you have found a vulnerability in BIND 9, Kea DHCP, Stork, or ISC DHCP, or if you wish to inquire about a vulnerability that you have learned about which has not yet been publicly announced, ISC encourages you to take one or more of the following actions, as appropriate:
- Open a confidential GitLab issue (preferred) or send email to bind-security@isc.org - for BIND 9-related vulnerabilities
- Send email to kea-security@isc.org - for Kea DHCP-related vulnerabilities
- Send email to stork-security@isc.org - for Stork-related vulnerabilities
Emails to any of the above addresses automatically create secure, confidential issues in ISC’s GitLab instance.
- security-officer@isc.org - for any other security issues*
* If possible, we ask that you please encrypt your communications to the security-officer@isc.org address using the ISC Security Officer public key found on our PGP Key page. Our OpenPGP keys are also available from our FTP site.
More information is available about How to Submit a Bug Report.
Learn more about ISC’s Software Defect and Vulnerability Disclosure Policy.
Reporting a Bug That Is NOT a Software Vulnerability
- Please report bugs in BIND 9 by opening an issue in our BIND GitLab.
- Please report bugs in Kea at our Kea GitLab.
- Please report bugs in Stork in our Stork GitLab.
- Please report ISC DHCP bugs at our ISC DHCP GitLab.
Ensuring You Are Not Running Software With a Known Vulnerability
For a listing of vulnerabilities in BIND 9, please see the BIND 9 Vulnerability Matrix in ISC’s Knowledgebase. Kea and ISC DHCP CVEs are also available in our Knowledgebase.
To ensure that you are notified of any new discovered vulnerabilities, you should become an ISC support subscriber, which entitles you to early notification of vulnerabilities via a secure, private support queue.
You can also follow ISC vulnerability notices by subscribing to one of our community mailing lists. Please subscribe to the BIND-announce, Kea-announce, and/or DHCP-announce list(s), as appropriate.
ISC uses the CVSS calculator, a program of first.org and NIST, to determine the severity of potential security issues. We invite users to read more about our CVSS Scoring Guidelines in our Knowledgebase.