Description
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A recursive BIND server can crash when it receives a recursive query followed by a non‑recursive query. The crash occurs due to an assertion failure that is triggered when the server has at least two RPZ zones with differing "recursive-only" settings (one set to yes, another set to no). The effect is a server exit that renders the DNS service unavailable, which is a classic denial of service. The weakness involved is an assertion flaw, as identified by CWE‑617.

Affected Systems

The vulnerability affects ISC BIND 9. The affected releases include 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3‑S1 through 9.18.50‑S1, and 9.20.9‑S1 through 9.20.29‑S1. All installations that enable recursion and have at least two RPZ zones configured are potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.5 classifies the issue as high severity. EPSS information is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is remote network traffic, given that any client capable of issuing DNS queries with RD=1 followed by RD=0 can trigger the crash when the server is configured as described. Because the condition requires at least two RPZ zones with conflicting recursive‑only settings, the attack requires an attacker to target a vulnerable server that meets these configuration prerequisites. The analysis is based on the description; the exact probability of exploitation remains undefined due to missing EPSS data.

Generated by OpenCVE AI on October 21, 2026 at 18:40 UTC.

Remediation

Vendor Solution

Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.

Vendor Workaround

No workarounds known.

OpenCVE Recommended Actions

  • Upgrade to the patched release that corresponds to your current BIND 9 version, such as 9.20.30, 9.21.27, or 9.20.30‑S1.
  • As a temporary measure, disable recursive queries on the server or reconfigure all RPZ zones to use consistent recursive‑only settings (all yes or all no) to avoid the assertion trigger.
  • If possible, remove or disable RPZ zones entirely until the patch is applied, thereby eliminating the configuration scenario that triggers the crash.

Generated by OpenCVE AI on October 21, 2026 at 18:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6576-1 bind9 security update
Ubuntu USN Ubuntu USN USN-8969-1 Bind vulnerabilities
History

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 21 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Isc bind 9
Vendors & Products Isc bind 9

Wed, 21 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Description A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Title Specific RPZ configurations and query patterns may result in an unexpected exit
First Time appeared Isc
Isc bind
Weaknesses CWE-617
CPEs cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*
Vendors & Products Isc
Isc bind
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Isc Bind Bind 9
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: isc

Published:

Updated: 2026-10-21T17:19:13.974Z

Reserved: 2026-09-24T11:09:13.016Z

Link: CVE-2026-97313

cve-icon Vulnrichment

Updated: 2026-10-21T17:09:55.361Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T13:21:09.270

Modified: 2026-10-26T21:10:00.170

Link: CVE-2026-97313

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-21T00:00:00Z

Links: CVE-2026-97313 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T22:45:14Z

Weaknesses