{"id":"CVE-2026-96888","title":"Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization","summary":"A BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-476","CWE-617"],"vendor":"ISC","product":"BIND 9","affected":["bind_9 >= 9.16.0 <= 9.18.50","bind_9 >= 9.20.0 <= 9.20.29","bind_9 >= 9.21.0 <= 9.21.26","bind_9 >= 9.16.8-S1 <= 9.18.50-S1","bind_9 >= 9.20.9-S1 <= 9.20.29-S1"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:46:17.594Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96888","references":[{"url":"https://kb.isc.org/docs/cve-2026-96888","label":"CVE-2026-96888"},{"url":"https://downloads.isc.org/isc/bind9/9.20.30"},{"url":"https://downloads.isc.org/isc/bind9/9.21.27"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T12:48:53.574Z","slug":"CVE-2026-96888","body":"## Overview\n\nA BIND resolver that is configured with both a \"redirect\" zone and \"qname-minimization strict\" may abort with an assertion failure while processing the redirect.\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\n## Affected\n\n- `bind_9 >= 9.16.0 <= 9.18.50`\n- `bind_9 >= 9.20.0 <= 9.20.29`\n- `bind_9 >= 9.21.0 <= 9.21.26`\n- `bind_9 >= 9.16.8-S1 <= 9.18.50-S1`\n- `bind_9 >= 9.20.9-S1 <= 9.20.29-S1`\n\n## Remediation\n\nUpgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.\n\n### Workarounds\n\nNo workarounds known.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}