UBUNTU-CVE-2026-96888: High severity ubuntu/bind9 vulnerability

Q: Which deployments are exposed to this issue?

BIND resolvers are affected only when configured with both a "redirect" zone and "qname-minimization strict". The affected version ranges include 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Q: What can an unauthenticated attacker do?

An attacker can remotely trigger an assertion failure while the resolver processes the redirect, causing the BIND resolver to abort. The supplied vector indicates network access is sufficient, with low attack complexity and no privileges or user interaction required.

Q: Are default BIND resolver configurations affected?

The issue requires the simultaneous use of a redirect zone and strict QNAME minimization. The provided information does not establish whether either setting is enabled by default.

Published Oct 21, 2026

Updated

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Affected Software

13 affected componentsFixes available

ubuntu/bind9*

ubuntu/isc-dhcp*

ubuntu/bind9*

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.8

1:9.18.39-0ubuntu0.22.04.8

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.9

1:9.18.39-0ubuntu0.24.04.9

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.5

1:9.20.24-1ubuntu0.5

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.9
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.5

Event History

Oct 21, 2026

CVE Published

via OSV·01:21 PM

Data Sourced

via OSV·01:21 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

BIND resolvers are affected only when configured with both a "redirect" zone and "qname-minimization strict". The affected version ranges include 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

What can an unauthenticated attacker do?

An attacker can remotely trigger an assertion failure while the resolver processes the redirect, causing the BIND resolver to abort. The supplied vector indicates network access is sufficient, with low attack complexity and no privileges or user interaction required.

Are default BIND resolver configurations affected?

The issue requires the simultaneous use of a redirect zone and strict QNAME minimization. The provided information does not establish whether either setting is enabled by default.

UBUNTU-CVE-2026-96888: High severity ubuntu/bind9 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an unauthenticated attacker do?

Are default BIND resolver configurations affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an unauthenticated attacker do?

Are default BIND resolver configurations affected?