{"id":"CVE-2026-97313","title":"Specific RPZ configurations and query patterns may result in an unexpected exit","summary":"A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recur…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-617"],"vendor":"ISC","product":"BIND 9","affected":["bind_9 >= 9.16.0 <= 9.18.50","bind_9 >= 9.20.0 <= 9.20.29","bind_9 >= 9.21.0 <= 9.21.26","bind_9 >= 9.11.3-S1 <= 9.18.50-S1","bind_9 >= 9.20.9-S1 <= 9.20.29-S1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-21T15:18:26.657640Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T17:19:13.974Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97313","references":[{"url":"https://kb.isc.org/docs/cve-2026-97313","label":"CVE-2026-97313"},{"url":"https://downloads.isc.org/isc/bind9/9.20.30"},{"url":"https://downloads.isc.org/isc/bind9/9.21.27"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T13:57:01.187Z","slug":"CVE-2026-97313","body":"## Overview\n\nA recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of \"recursive-only yes\", and the other with \"recursive-only no\".\nThis issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\n## Affected\n\n- `bind_9 >= 9.16.0 <= 9.18.50`\n- `bind_9 >= 9.20.0 <= 9.20.29`\n- `bind_9 >= 9.21.0 <= 9.21.26`\n- `bind_9 >= 9.11.3-S1 <= 9.18.50-S1`\n- `bind_9 >= 9.20.9-S1 <= 9.20.29-S1`\n\n## Remediation\n\nUpgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.\n\n### Workarounds\n\nNo workarounds known.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}