How do I check whether I am affected by CVE-2026-96888?

- Run `named -V` or `named -v` to read the BIND version. - Check named.conf for a `zone` block that uses `type redirect;` together with `qname-minimization strict;`.

What is the fix for CVE-2026-96888?

- Upgrade BIND 9 to a fixed release: 9.18.51 or later on the 9.18 branch, 9.20.30 or later on 9.20, 9.21.27 or later on 9.21 (the sources list the affected ranges; confirm the fixed versions against the ISC advisory). - Or remove the redirect zone or set qname-minimization to a value other than strict until upgraded.

Who is not affected by CVE-2026-96888?

Not affected if: authoritative-only, default-qname-minimization, no-redirect-zone.

Live › vulnerability › CVE-2026-96888

Go to dashboard

high7.5Infrastructure

BIND: redirect zone with strict qname minimization crashes resolver

A BIND 9 resolver configured with both a redirect zone and qname-minimization strict can abort on an assertion failure while processing the redirect. The sources describe a crash (denial of service), not code execution.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.5

high

scored by [email protected]

known so far4 of 6

missing: versions, primary source

First public: Oct 21, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.5% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Resolver process aborts, causing DNS outage until restarted.
CVSS said: 7.5. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

Only resolvers that run a redirect zone and set qname-minimization strict at the same time are exposed. Authoritative-only servers and resolvers without a redirect zone can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-96888

Go to dashboard

high7.5Infrastructure

BIND: redirect zone with strict qname minimization crashes resolver

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.5

high

scored by [email protected]

known so far4 of 6

missing: versions, primary source

First public: Oct 21, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.5% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: network.
Worst case: Resolver process aborts, causing DNS outage until restarted.
CVSS said: 7.5. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

Only resolvers that run a redirect zone and set qname-minimization strict at the same time are exposed. Authoritative-only servers and resolvers without a redirect zone can skip it.

Know the next one before it finds you.

Add to Slack

BIND: redirect zone with strict qname minimization crashes resolver

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

BIND: redirect zone with strict qname minimization crashes resolver

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources