---
id: "CVE-2026-97313"
kind: "vulnerability"
aliases: ["CVE-2026-97313"]
title: "BIND: recursion-desired query sequence crashes recursive resolver with RPZ config"
severity: "high"
cvss: 7.5
epss: 0.00448
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bind", "dns", "infrastructure", "isc-bind", "self-hosted"]
not_affected_if: ["authoritative-only", "no-rpz", "recursion-disabled"]
published_at: "2026-10-21T13:21:09+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:16:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97313", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-97313", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# BIND: recursion-desired query sequence crashes recursive resolver with RPZ config

A recursive BIND 9 resolver that receives a query with recursion desired followed by a non-recursive query can exit on an assertion failure. The result is a denial of service that takes the resolver offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `named -v` or `named -V` to read the installed BIND version and compare it to the affected ranges.
- Check named.conf for `recursion yes` or default recursion together with at least two `response-policy` zones, one with `recursive-only yes` and one with `recursive-only no`.

## Fix

- Move BIND 9 to a patched release outside the affected ranges: 9.18.51 or later on the 9.18 branch, 9.20.30 or later on the 9.20 branch, 9.21.27 or later on the 9.21 branch, and the corresponding -S fixed releases for Supported Preview/ESV builds.
- If upgrade is delayed, make sure only one RPZ zone uses the affected recursive-only setting or disable recursion for untrusted clients.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97313
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-97313

## From the sources

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_