CVE-2026-96888: Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.27 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30-S1
Event History
Frequently Asked Questions
Which deployments are exposed?
Only BIND resolvers configured with both a "redirect" zone and "qname-minimization strict" are affected. The issue can cause named to terminate, creating an availability impact.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates the issue is reachable over the network with low attack complexity, without privileges or user interaction.
How can I determine whether an instance is affected?
Check whether the resolver uses both affected configuration features and whether its version falls within 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.29-S1.
What can be done if upgrading is not immediately possible?
Avoid using the affected combination of a redirect zone and strict QNAME minimization. Removing either condition prevents the configuration described as triggering the assertion failure.