CVE-2026-96888
Received
Received - Intake
Assertion Failure in BIND Resolver with Redirect Zone and Qname-Minimization
Vulnerability report for CVE-2026-96888, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: Internet Systems Consortium (ISC)
Description
Description
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ISC | BIND | 9 9.16.0 |
| ISC | BIND | 9 9.20.0 |
| ISC | BIND | 9 9.21.0 |
| ISC | BIND | 9 9.16.8-S1 |
| ISC | BIND | 9 9.20.9-S1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
