{"id":"CVE-2026-96888","kind":"vulnerability","aliases":["CVE-2026-96888"],"related":[],"title":"BIND: redirect zone with strict qname minimization crashes resolver","description":"A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","summary":"A BIND 9 resolver configured with both a redirect zone and qname-minimization strict can abort on an assertion failure while processing the redirect. The sources describe a crash (denial of service), not code execution.","severity":"high","cvss":7.5,"epss":0.00461,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bind","dns-resolver","infrastructure","self-hosted"],"not_affected_if":["authoritative-only","default-qname-minimization","no-redirect-zone"],"how_to_check":"- Run `named -V` or `named -v` to read the BIND version.\n- Check named.conf for a `zone` block that uses `type redirect;` together with `qname-minimization strict;`.","fix":"- Upgrade BIND 9 to a fixed release: 9.18.51 or later on the 9.18 branch, 9.20.30 or later on 9.20, 9.21.27 or later on 9.21 (the sources list the affected ranges; confirm the fixed versions against the ISC advisory).\n- Or remove the redirect zone or set qname-minimization to a value other than strict until upgraded.","status":"open","published_at":"2026-10-21T13:21:08+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:50+00:00","updated_at":"2026-10-25T03:16:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:16:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade BIND 9 to a fixed release: 9.18.51 or later on the 9.18 branch, 9.20.30 or later on 9.20, 9.21.27 or later on 9.21 (the sources list the affected ranges; confirm the fixed versions against the ISC advisory).\n- Or remove the redirect zone or set qname-minimization to a value other than strict until upgraded.","reach":"network","title":"BIND: redirect zone with strict qname minimization crashes resolver","impact":"low","summary":"A BIND 9 resolver configured with both a redirect zone and qname-minimization strict can abort on an assertion failure while processing the redirect. The sources describe a crash (denial of service), not code execution.","category":"infrastructure","nicknames":[],"who_cares":["bind","dns-resolver","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"resolver process aborts, causing DNS outage until restarted","analyst_note":"","how_to_check":"- Run `named -V` or `named -v` to read the BIND version.\n- Check named.conf for a `zone` block that uses `type redirect;` together with `qname-minimization strict;`.","needs_analyst":false,"not_affected_if":["no-redirect-zone","default-qname-minimization","authoritative-only"],"who_is_affected":"Only resolvers that run a redirect zone and set qname-minimization strict at the same time are exposed. Authoritative-only servers and resolvers without a redirect zone can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000621,"input_tokens":3409,"output_tokens":560,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-96888':12A,15A '9':26B,90C '9.16.0':92C '9.16.8':101C '9.18.50':94C,104C '9.20.0':95C '9.20.29':97C,110C '9.20.9':107C '9.21.0':98C '9.21.26':100C 'abort':40B,77C 'affect':88C 'assert':43B,80C 'bind':1A,16B,25B,61C,89C 'code':58B 'configur':28B,65C 'crash':8A,53B 'cve':10A,13A 'denial':54B 'describ':51B 'dns':18B 'dns-resolv':17B 'execut':59B 'failur':44B,81C 'host':23B 'infrastructur':20B 'issu':87C 'may':76C 'minim':7A,37B,74C 'process':46B,83C 'qname':6A,36B,73C 'qname-minim':35B,72C 'redirect':2A,32B,48B,69C,85C 'resolv':9A,19B,27B,62C 's1':102C,105C,108C,111C 'self':22B 'self-host':21B 'servic':56B 'sourc':50B 'strict':5A,38B,75C 'version':91C 'zone':3A,33B,70C","nicknames":[],"mitigations":[],"who_affected":"Only resolvers that run a redirect zone and set qname-minimization strict at the same time are exposed. Authoritative-only servers and resolvers without a redirect zone can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:21:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-officer@isc.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96888","severity":null,"published_at":"2026-10-21T13:21:08+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96888","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96888","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}