7.5High

CVE-2026-96888Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

ISC BIND 9 Published: 2026-10-21 15:46 (12 days ago)

Description

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Weakness (CWE): CWE-476 CWE-617

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
isc	bind	9.16.0 – ≤ 9.18.50
ISC	BIND 9	9.16.0 – ≤ 9.18.50, 9.20.0 – ≤ 9.20.29, 9.21.0 – ≤ 9.21.26, 9.16.8-S1 – ≤ 9.18.50-S1, 9.20.9-S1 – ≤ 9.20.29-S1

References and patches

CVE-2026-96888 vendor-advisory
https://downloads.isc.org/isc/bind9/9.20.30 patch
https://downloads.isc.org/isc/bind9/9.21.27 patch

CVSS score

7.5High

Source: isc · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All scores (2)

cna	CVSS 3.1	7.5High
security-officer@isc.org	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

0.46%

higher than 40% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-09-23
Published2026-10-21 15:46
Reached IP-DB2026-10-24 23:44
Last updated2026-10-27 00:10

Assigned by (CNA): isc
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — ISC BIND 9

7.5High

CVE-2026-97313 12 days ago

Specific RPZ configurations and query patterns may result in an unexpected exit

ISC BIND 9

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have …

8.1High

CVE-2026-94300 12 days ago

Concurrent GSS-TSIG messages corrupt memory

ISC BIND 9

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacke…

7.5High

CVE-2026-19630 12 days ago

Amplified resource exhaustion in inbound message processing

ISC BIND 9

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate am…

5.9Medium

CVE-2026-77119 1 month ago

NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

ISC BIND 9

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…

5.3Medium

CVE-2026-75029 1 month ago

Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

ISC BIND 9

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …

5.3Medium

CVE-2026-19668 1 month ago

Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching

ISC BIND 9

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on "max-records-per-type" and "max-types-per-name" help mitigate the exposure. This issue aff…