UBUNTU-CVE-2026-97313: High severity ubuntu/bind9 vulnerability

Q: Which configurations are exposed?

Exposure requires all of the following: recursive queries are allowed, at least two RPZ zones are configured, one RPZ zone uses the default "recursive-only yes" setting, and another uses "recursive-only no". A server that does not meet these conditions is not described as vulnerable.

Q: What must an attacker do to trigger the issue?

An attacker must send a recursive query with RD=1 and then a non-recursive query with RD=0 to the affected recursive BIND server. The supplied vector indicates this can be performed over the network without privileges or user interaction.

Q: How can I determine whether an installation needs remediation?

Check whether the deployed BIND version falls within 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.29-S1. Then review the BIND configuration for allowed recursion and the required combination of two RPZ zones with differing recursive-only settings.

Q: What can be changed if patching is not immediately possible?

Reduce exposure by ensuring the server does not retain the vulnerable configuration combination: recursive queries allowed together with at least two RPZ zones, one set to "recursive-only yes" and another set to "recursive-only no". Any configuration change should be evaluated for its operational effect on DNS resolution and RPZ policy enforcement.

Published Oct 21, 2026

Updated

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Affected Software

13 affected componentsFixes available

ubuntu/bind9*

ubuntu/isc-dhcp*

ubuntu/bind9*

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.22.04.8

1:9.18.39-0ubuntu0.22.04.8

ubuntu/bind9-libs*

ubuntu/bind9<1:9.18.39-0ubuntu0.24.04.9

1:9.18.39-0ubuntu0.24.04.9

ubuntu/isc-dhcp*

ubuntu/bind9<1:9.20.24-1ubuntu3.1

1:9.20.24-1ubuntu3.1

ubuntu/bind9<1:9.20.24-1ubuntu0.5

1:9.20.24-1ubuntu0.5

ubuntu/isc-dhcp*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.22.04.8
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.18.39-0ubuntu0.24.04.9
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu3.1
Upgrade
Upgrade ubuntu/bind9 to a version that resolves this vulnerability.
Fixed in 1:9.20.24-1ubuntu0.5

Event History

Oct 21, 2026

CVE Published

via OSV·01:21 PM

Data Sourced

via OSV·01:21 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which configurations are exposed?

Exposure requires all of the following: recursive queries are allowed, at least two RPZ zones are configured, one RPZ zone uses the default "recursive-only yes" setting, and another uses "recursive-only no". A server that does not meet these conditions is not described as vulnerable.

What must an attacker do to trigger the issue?

An attacker must send a recursive query with RD=1 and then a non-recursive query with RD=0 to the affected recursive BIND server. The supplied vector indicates this can be performed over the network without privileges or user interaction.

How can I determine whether an installation needs remediation?

Check whether the deployed BIND version falls within 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.29-S1. Then review the BIND configuration for allowed recursion and the required combination of two RPZ zones with differing recursive-only settings.

What can be changed if patching is not immediately possible?

Reduce exposure by ensuring the server does not retain the vulnerable configuration combination: recursive queries allowed together with at least two RPZ zones, one set to "recursive-only yes" and another set to "recursive-only no". Any configuration change should be evaluated for its operational effect on DNS resolution and RPZ policy enforcement.

UBUNTU-CVE-2026-97313: High severity ubuntu/bind9 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which configurations are exposed?

What must an attacker do to trigger the issue?

How can I determine whether an installation needs remediation?

What can be changed if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which configurations are exposed?

What must an attacker do to trigger the issue?

How can I determine whether an installation needs remediation?

What can be changed if patching is not immediately possible?