CVE-2026-97313

Awaiting Analysis Awaiting Analysis - Queue

Recursive Query Handling Flaw in BIND Server

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Internet Systems Consortium (ISC)

Description

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-26

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-97313

EUVD

EUVD-2026-107256

Affected Vendors & Products

Vendor	Product	Version / Range
ISC	BIND 9	9.16.0
ISC	BIND 9	9.20.0
ISC	BIND 9	9.21.0
ISC	BIND 9	9.11.3-S1
ISC	BIND 9	9.20.9-S1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability affects BIND 9 recursive DNS servers. It occurs when a server receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0). The server must allow recursive queries and have two RPZ zones configured: one with 'recursive-only yes' and another with 'recursive-only no'. This causes the server to exit unexpectedly, resulting in a denial of service.

Detection Guidance

Check BIND version to confirm if it is vulnerable: named -v. Monitor named logs for assertion failures or crashes. Test with recursive and non-recursive queries to see if the server exits unexpectedly.

Impact Analysis

The vulnerability can cause your BIND 9 DNS server to crash, leading to service disruption. This means DNS queries may fail, websites and services relying on DNS resolution may become unavailable, and network operations could be interrupted until the server is restarted or patched.

Compliance Impact

This vulnerability causes a denial of service by crashing BIND servers, which could disrupt DNS services critical for compliance with standards like GDPR (data processing) and HIPAA (healthcare systems). Downtime may lead to service unavailability, impacting data access and processing requirements.

Mitigation Strategies

Upgrade BIND to a patched version: 9.20.30, 9.21.27, or later. Remove or reconfigure RPZ zones to avoid mixing recursive-only yes and no settings. Restart the named service after upgrade.

Hi! I’m here to help you understand CVE-2026-97313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...