ISC ships BIND 9.20.27 and 9.21.25 after shifting to monthly security updates
The August 19 releases are the first monthly maintenance drops under a new cadence tied to a surge in LLM-driven vulnerability discovery.
ISC released both BIND 9.20.27 and BIND 9.21.25 on today. The timing matters. These are the first monthly maintenance releases since ISC said on May 12, 2026, that LLM analysis of open source code is feeding an unprecedented flood of vulnerability reports. For operators, the message is straightforward. If you run BIND 9.20, move to 9.20.27. If you are still stuck on 9.18, that branch is dead. It hit end of life in June 2026 with 9.18.50 as its final release.
A stable branch, a development branch
BIND 9.20.27 is the current stable branch and ISC's extended support version. It carries an end of life target for Q2 2028. The previous stable release was 9.20.26, which landed on July 22, 2026.
BIND 9.21.25 is the development branch. You use it to test new features before they land in the stable line. The prior development release was 9.21.23 from July 2026. ISC still says it has not paused feature work, even as it prioritizes vulnerability fixes. Keep in mind that 9.21 is not the release most production systems should be tracking.
Both releases come with support packages for RHEL, CentOS, Fedora, Ubuntu, Debian, and Docker. If you want packages, the COPR repository covers stable RHEL, CentOS, and Fedora builds, while the Ubuntu PPA and Debian repository do the same for those platforms. Docker users can pull the specific tag from the Docker Hub image.
The vulnerability backlog is the real story
ISC reported 10 CVEs fixed in the July 2026 release, 9.20.26 and 9.21.24. Most of them involved DNSSEC record handling, crashes, CPU exhaustion, or memory overruns. CVE-2026-13321 is the headline bug, a DNSSEC validation bypass through an out-of-zone NSEC Next field with a CVSS score of 8.6. Attackers could exploit it remotely.
CVE-2026-11721 is another one to watch. It describes a potential cache poisoning issue involving wildcard records, RRSIG signatures, and label count discrepancies. CVE-2026-11331 is less flashy, but it matters if you rely on Response Policy Zones. A crafted query can trigger a NAMETOOLONG error during RPZ processing and defeat a wildcard CNAME policy.
ISC credited Qifan Zhang of Palo Alto Networks with most of the findings, and Laith Mash'al, also known as 0xmshal, with one. The company disclosed them publicly on July 22, 2026, after an Early Vulnerability Notice that began on July 15.
The LLM angle is not just a research curiosity here. It is changing how defenders plan maintenance windows. In that May 12, 2026 blog post, ISC said it was triaging reports at a rate that "exceeds 10X the historic levels." It also said that, "for the foreseeable future, users should expect security fixes in every monthly BIND maintenance release." ISC deferred the next stable branch, BIND 9.22, until at least the end of 2026.
ISC also pushed operators toward a blunt maintenance rule: "We will not be able to invest extra effort to determine exactly which minor release introduced an issue; users should update to the latest maintenance version on their branch."
That is a big ask. In normal times, you can evaluate a CVE, decide whether it applies, and patch on your own schedule. Under this cadence, the safer path is to track every monthly drop. However, at the same time, monthly security drops create a real operational cost. For most teams, DNS patching now starts to resemble browser update pressure, except with a bigger blast radius. For what it's worth, that is a far heavier operating rhythm than most DNS admins had to plan for last year.
If you run BIND 9.18, there is no patch to chase. Migrate to 9.20.27 now. If your pipeline can tolerate the churn, plan for monthly security updates through the rest of 2026. ISC says it will reevaluate the cadence at the end of 2026 and hopes to return to quarterly releases in Q1 2027.
Head here to the ISC downloads page if you want the full list, tarball signatures, and documentation. The vulnerability matrix is also a good place to see exactly which branches are affected. If you need a cleaner feed, subscribe to bind-announce.
