# Notes for BIND 9.14.1

- In certain configurations, `named` could crash with an assertion failure if `nxdomain-redirect` was in use and a redirected query resulted in an NXDOMAIN from the cache. This flaw is disclosed in CVE-2019-6467. [GL #880]

- The TCP client quota set using the `tcp-clients` option could be exceeded in some cases. This could lead to exhaustion of file descriptors. (CVE-2018-5743) [GL #615]

- The new `add-soa` option specifies whether or not the `response-policy` zone's SOA record should be included in the additional section of RPZ responses. [GL #865]

- The `allow-update` and `allow-update-forwarding` options were inadvertently treated as configuration errors when used at the `options` or `view` level. This has now been corrected. [GL #913]