CVE-2026-97313: Specific RPZ configurations and query patterns may result in an unexpected exit
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.27 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30-S1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
A recursive BIND server is vulnerable only if it permits recursive queries and has at least two RPZ zones configured: one using the default "recursive-only yes" setting and another using "recursive-only no". Servers without that mixed RPZ configuration are not described as affected.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges, and no user interaction; the triggering sequence is a recursive query (RD=1) followed by a non-recursive query (RD=0).
Which BIND versions are affected?
Affected release ranges are 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.