CVE-2026-96888
Awaiting Analysis Awaiting Analysis - Queue

Assertion Failure in BIND Resolver with Redirect Zone and Qname-Minimization

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Internet Systems Consortium (ISC)

Description
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-26
Generated
2026-11-10
AI Q&A
2026-10-22
EPSS Evaluated
2026-11-09
NVD
CVE-2026-96888
EUVD
EUVD-2026-107255

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
ISC BIND 9 9.16.0
ISC BIND 9 9.20.0
ISC BIND 9 9.21.0
ISC BIND 9 9.16.8-S1
ISC BIND 9 9.20.9-S1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96888 is a vulnerability in BIND 9 DNS resolver software where a resolver configured with both a redirect zone and qname-minimization strict settings may crash due to an assertion failure while processing the redirect. This causes the named service to terminate unexpectedly, resulting in a denial-of-service condition.

Detection Guidance

Check BIND version with 'named -v' or 'rpm -qa | grep bind' to identify vulnerable versions (9.16.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26). Inspect named.conf for 'redirect' zone and 'qname-minimization strict' settings. Monitor named service logs for assertion failures or crashes.

Impact Analysis

This vulnerability can cause your BIND 9 DNS resolver to crash, leading to service disruption and unavailability of DNS resolution for your systems. It may result in network outages or degraded performance for services relying on DNS.

Compliance Impact

This vulnerability causes a denial-of-service condition in BIND 9 DNS resolver software by triggering an assertion failure when specific configurations are enabled. While it does not directly impact data confidentiality or integrity, service disruption could affect compliance with regulations requiring high availability of critical systems, such as DNS resolution for healthcare or financial services.

Mitigation Strategies
  • Upgrade BIND to version 9.20.30, 9.21.27, or their Supported Preview Editions (9.20.30-S1, 9.21.27-S1) immediately.
  • Restart the named service after upgrade to apply patches.
  • Remove or disable 'redirect' zones if not required, or disable 'qname-minimization strict' as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96888. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...