{"id":"CVE-2026-97313","kind":"vulnerability","aliases":["CVE-2026-97313"],"related":[],"title":"BIND: recursion-desired query sequence crashes recursive resolver with RPZ config","description":"A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\".\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","summary":"A recursive BIND 9 resolver that receives a query with recursion desired followed by a non-recursive query can exit on an assertion failure. The result is a denial of service that takes the resolver offline.","severity":"high","cvss":7.5,"epss":0.00448,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bind","dns","infrastructure","isc-bind","self-hosted"],"not_affected_if":["authoritative-only","no-rpz","recursion-disabled"],"how_to_check":"- Run `named -v` or `named -V` to read the installed BIND version and compare it to the affected ranges.\n- Check named.conf for `recursion yes` or default recursion together with at least two `response-policy` zones, one with `recursive-only yes` and one with `recursive-only no`.","fix":"- Move BIND 9 to a patched release outside the affected ranges: 9.18.51 or later on the 9.18 branch, 9.20.30 or later on the 9.20 branch, 9.21.27 or later on the 9.21 branch, and the corresponding -S fixed releases for Supported Preview/ESV builds.\n- If upgrade is delayed, make sure only one RPZ zone uses the affected recursive-only setting or disable recursion for untrusted clients.","status":"open","published_at":"2026-10-21T13:21:09+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:16:50+00:00","updated_at":"2026-10-25T03:16:50+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T03:16:50Z","model":"claude-haiku-5-5","output":{"fix":"- Move BIND 9 to a patched release outside the affected ranges: 9.18.51 or later on the 9.18 branch, 9.20.30 or later on the 9.20 branch, 9.21.27 or later on the 9.21 branch, and the corresponding -S fixed releases for Supported Preview/ESV builds.\n- If upgrade is delayed, make sure only one RPZ zone uses the affected recursive-only setting or disable recursion for untrusted clients.","reach":"network","title":"BIND: recursion-desired query sequence crashes recursive resolver with RPZ config","impact":"medium","summary":"A recursive BIND 9 resolver that receives a query with recursion desired followed by a non-recursive query can exit on an assertion failure. The result is a denial of service that takes the resolver offline.","category":"infrastructure","nicknames":[],"who_cares":["bind","dns","self-hosted","isc-bind"],"confidence":0.8,"needs_auth":"no","worst_case":"resolver process exits, causing DNS service outage","analyst_note":"","how_to_check":"- Run `named -v` or `named -V` to read the installed BIND version and compare it to the affected ranges.\n- Check named.conf for `recursion yes` or default recursion together with at least two `response-policy` zones, one with `recursive-only yes` and one with `recursive-only no`.","needs_analyst":false,"not_affected_if":["authoritative-only","no-rpz","recursion-disabled"],"who_is_affected":"Only recursive BIND resolvers that have at least two RPZ zones configured with different recursive-only settings are exposed. Authoritative-only servers and resolvers without RPZ can skip this one.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3488,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97313':15A,18A '0':86C '1':77C '9':31B,139C '9.11.3':150C '9.16.0':141C '9.18.50':143C,153C '9.20.0':144C '9.20.29':146C,159C '9.20.9':156C '9.21.0':147C '9.21.26':149C 'affect':137C 'allow':106C 'assert':51B,91C 'bind':1A,19B,24B,30B,67C,103C,138C 'config':12A 'configur':116C 'crash':7A 'cve':13A,16A 'default':120C 'denial':57B,96C 'desir':4A,39B,75C 'dns':20B 'exit':48B,88C 'failur':52B,92C 'follow':40B,78C 'host':27B 'infrastructur':21B 'isc':23B 'isc-bind':22B 'issu':136C 'least':112C 'may':87C 'must':105C 'non':44B,82C 'non-recurs':43B,81C 'offlin':64B 'one':117C 'queri':5A,36B,46B,72C,84C,108C 'rd':76C,85C 'receiv':34B,70C 'recurs':3A,8A,29B,38B,45B,66C,74C,83C,107C,124C,132C 'recursion-desir':2A 'recursive-on':123C,131C 'resolv':9A,32B,63B 'result':54B,93C 'rpz':11A,114C 's1':151C,154C,157C,160C 'self':26B 'self-host':25B 'sequenc':6A 'server':68C,104C 'servic':59B,98C 'set':121C 'take':61B 'two':113C 'version':140C 'vulner':101C 'yes':126C 'zone':115C","nicknames":[],"mitigations":[],"who_affected":"Only recursive BIND resolvers that have at least two RPZ zones configured with different recursive-only settings are exposed. Authoritative-only servers and resolvers without RPZ can skip this one.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:21:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-officer@isc.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97313","severity":null,"published_at":"2026-10-21T13:21:09+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-97313","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97313","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}