CVE-2026-96888High· 7.5▾ TwilightA BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
bind_9 >= 9.16.0 <= 9.18.50bind_9 >= 9.20.0 <= 9.20.29bind_9 >= 9.21.0 <= 9.21.26bind_9 >= 9.16.8-S1 <= 9.18.50-S1bind_9 >= 9.20.9-S1 <= 9.20.29-S1Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.
No workarounds known.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97313High· 7.5Specific RPZ configurations and query patterns may result in an unexpected exit
CVE-2026-19630High· 7.5Amplified resource exhaustion in inbound message processing
CVE-2026-94300High· 8.1Concurrent GSS-TSIG messages corrupt memory
CVE-2026-77692High· 7.5An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9…
CVE-2026-80274High· 7.5If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an un…
CVE-2026-76163High· 7.5If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 ver…