Summary

  • Internet Systems Consortium fixes BIND 9 inside three published boundaries: a four-year support ladder for even-numbered stable branches, a CVSS 7.0 threshold below which no public advisory is required, and a rule that only the newest monthly release on a supported branch is patched.
  • Debian's own records extend repair past ISC's end-of-life marker for the 9.18 branch while still counting 15 open security issues against that distribution, and no public measurement was located of how many deployed BIND servers actually run a fixed version.

Repair is usually described as an engineering event: a defect is found, code is written, a version ships. In BIND 9 the version that ships is chosen by policy before it is chosen by engineering, and three written commitments decide most of the outcome.

The supported set is declared, bounded and self-described as approximate

ISC's software support policy sorts BIND 9 majors into four kinds — Development, Stable, Extended Support and the subscription Supported Preview editions — and places even-numbered Stable branches on a four-year clock: roughly twelve months of feature work and bug fixes, then extended support, then vulnerability fixes only. On that clock BIND 9.18 was first released in January 2022, declared an Extended Support Version in January 2023 and scheduled to end in June 2026; 9.20 was first released in July 2024; 9.16 was declared end of life in March 2024 with a final release the following month. The same page defers the next stable branch, 9.22, to at least the fourth quarter of 2026 and attributes the delay to the volume of potential vulnerabilities surfaced by LLM-assisted code analysis. It also states plainly that the guidance is a rough guide, not a guarantee. The organization behind it, Internet Systems Consortium, Inc., is therefore both the party that sets the clock and the only party that publishes it.

Severity, not discovery, decides whether disclosure happens

ISC's defect and vulnerability disclosure policy ties a public security disclosure to a computed CVSS score of 7.0 or above, rated HIGH or CRITICAL, classified as Type I when the issue is not in the wild and Type II when it is or when it is causing known problems. Type I gives support customers and OEMs formal notice with pre-release code three to five business days ahead — plus notification to root-server operators if authoritative service is affected — and operating-system packagers up to twenty-four hours of notice before public disclosure carries patched versions of all currently supported affected code. Type II aims to release resolving code within twenty-four hours of notification and does not always notify packagers before the public announcement. The policy's scope is stated just as precisely: it covers only currently supported products recommended for production use, and only the most recent monthly release of each stable maintenance version. End-of-life, end-of-maintenance and development versions are outside it, as are non-ISC dependencies bundled in ISC's packages.

A parallel channel is commercial. ISC's Early Vulnerability Notification service is sold with and alongside support subscriptions, allows up to four named individuals per subscriber, requires a non-disclosure agreement, and delivers notice as much as five days and at least three business days before the public announcement. On the same page ISC states that most BIND 9 vulnerabilities it discovers are ways to trigger INSIST or ASSERT failures that exit the server — potentially an effective denial-of-service attack — and that some vulnerabilities are disclosed publicly by the reporter, in which case ISC cannot manage the disclosure.

The fix matrix counts branches, not deployments

BIND 9's vulnerability matrix maps each CVE to the release that fixes it and shows only currently supported stable branches; older branches generally receive no fixes and may not even be assessed for vulnerability. In the retrieved excerpt the only non-retired column is 9.20, whose latest listed fix version is 9.20.29 dated 2026-09-16, while 9.18 is marked end of life, with 9.18.50 as the last release in the series and a standing instruction that end-of-life versions should be assumed vulnerable to new CVEs.

The cadence behind those rows changed in May 2026. ISC said that for the foreseeable future users should expect security fixes in every monthly BIND maintenance release instead of roughly one security release per quarter, that it would not spend effort identifying which minor release introduced an issue, and that users should update to the latest maintenance version on their branch. The same post reserves two options: ISC may begin issuing CVEs for more medium-severity issues in the CVSS 5–7 band, and may not always backport fixes for them. The threshold for early notices stays at 7.0.

The fixed side of the pipeline is visible in release notes. BIND 9.20.26 lists security fixes with CVE identifiers, including CVE-2026-10723 on NSEC3 signer-name verification and CVE-2026-10822 on a malformed DNSKEY assertion. The exit from a branch is equally specific: ISC's June 2026 announcement confirms that 9.18 maintenance ended with the June release planned for 17 June 2026 after about four and a half years, urges migration to 9.20 as ESV-quality, and dates the repointing of the bind-esv package repositories — private on 8 July 2026, public packages on 15 July 2026, a further maintenance release on 22 July 2026.

What the boundary does to real distributions

Debian is where the boundary becomes a package. Its security tracker lists bind9 in trixie at 1:9.20.26-1deb13u1 and in the trixie security pocket at 1:9.20.29-1deb13u1; in bookworm at 1:9.18.49-1deb12u1 and in the bookworm security pocket at 1:9.18.49-1deb12u2; and in forky and sid at 1:9.20.29-1. The page carries an open-issues section for the package. DSA-6395-1, issued by Salvatore Bonaccorso on 22 July 2026, handled nine bind9 CVEs with impacts described as DNSSEC validation bypass, RPZ policy bypass, cache poisoning and denial of service, and set the fixed version for the stable distribution at 1:9.20.26-1deb13u1. The Debian package tracker adds timing: 1:9.20.29-1deb13u1 was accepted into stable-security on 17 September 2026 and migrated to testing on 19 September 2026, and the tracker reports 15 open security issues in bookworm.

Two things are worth separating there. The 9.20.29 batch is the fast path: the fix appears in ISC's matrix dated 16 September 2026 and the packaged counterpart entered Debian's stable-security pocket the next day. Bookworm is the slow path: it still runs the 9.18 line ISC retired, with a security revision layered above the base package, and an open-issue count that has not reached zero. Repair has not stopped in either case, but in the second it is being delivered by a party other than the one that ended support.

A third record is explicit about branch lifecycles without relying on ISC. endoflife.date, which is community-maintained, lists BIND 9.20 security support ending 8 July 2028, 9.18 ended 30 June 2026 and 9.16 ended 31 March 2024, reproduces the even-numbered-stable rule, and adds a detail the vendor pages leave implicit: vulnerabilities in development branches are fixed as ordinary bugs without separate CVE advisories.

The records also disagree. BIND 9.18's end is dated three ways — the June release planned for 17 June 2026, the 2026-07-01 end-of-life marker in ISC's matrix, and 30 June 2026 at endoflife.date. The 9.22 deferral is phrased as at least the fourth quarter of 2026 in the support policy and as at least the end of 2026 in the May blog. Neither difference changes the direction of the pipeline; both show how loosely an end date can be fixed in public.

What none of these records establish

No public measurement was located of how many deployed BIND 9 servers run a fixed version within any window after an advisory. The matrix maps CVEs to releases, not releases to installed systems. The Debian trackers describe packages available for installation, not packages installed. endoflife.date describes support windows. The question that matters most operationally — how large the unpatched tail is — is therefore unanswered by every document in this set, and this briefing does not assert an adoption rate.

Two related gaps remain open on the record itself: how many sub-7.0 vulnerabilities are never backported is stated by ISC only as something it may not always do, and how long a distribution will keep carrying fixed versions of a branch ISC has retired is observable in bookworm but carries no published end date.

Every page cited here was retrieved as a provider-reported excerpt rather than opened directly, some dates were read from URL slugs, and the tracker pages are live and change; the two Debian pages give different base versions for the stable line — 9.20.26 in the security tracker's trixie column and 9.20.23 in the package tracker's stable column — while both place the security pocket at 9.20.29, which is consistent with pages captured at different times and cannot be resolved from this evidence.