A BIND resolver that is configured with both a redirect zone and strict QNAME minimization may crash with an assertion failure while processing the redirect. The crash results in the resolver terminating unexpectedly, which can repeatedly disrupt service availability. The vulnerability is a classic denial‑of‑service flaw that compromises the reliability of DNS resolution but does not directly grant code execution or data exfiltration rights.

ISC BIND 9 is affected. The vulnerable releases include 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and the equivalent 9.16.8‑S1 through 9.18.50‑S1 and 9.20.9‑S1 through 9.20.29‑S1. Any deployment running one of these versions with a redirect zone and strict QNAME minimization is at risk.

The CVSS score of 7.5 indicates a high impact with medium complexity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a remote DNS query that targets the redirect zone; an attacker who can direct traffic to the vulnerable server can repeatedly trigger the crash, causing a denial of service. The exploit condition requires the server to be configured with both a redirect zone and strict QNAME minimization, but the exact trigger details are not explicitly described, so the risk is inferred from the crash behavior. The vulnerability should be treated as high risk due to the potential to disrupt critical DNS infrastructure.