CVE-2026-96888: BIND DNS Server DOS Vulnerability

CVE-2026-96888 Overview

CVE-2026-96888 is a denial-of-service vulnerability in ISC BIND 9 resolvers. A resolver configured with both a redirect zone and qname-minimization strict can abort with an assertion failure while processing the redirect. The flaw is classified under CWE-476 (NULL Pointer Dereference) and carries a CVSS 3.1 score of 7.5. Remote, unauthenticated attackers can trigger the condition over the network to crash the named process. The issue affects multiple release branches of BIND 9, including supported and subscription editions.

Critical Impact
Unauthenticated attackers can remotely crash BIND 9 resolvers configured with a redirect zone and strict QNAME minimization, causing DNS service outages.

Affected Products

ISC BIND 9 versions 9.16.0 through 9.18.50
ISC BIND 9 versions 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26
ISC BIND 9 subscription editions 9.16.8-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1

Discovery Timeline

2026-10-21 - CVE-2026-96888 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-96888

Vulnerability Analysis

The vulnerability resides in the resolver code path that handles redirect zones. When BIND 9 is configured with both a redirect zone (type redirect) and qname-minimization strict, processing a redirect response triggers an assertion failure. The resolver reaches a state where it dereferences a NULL pointer during the redirect handling logic, invoking an assertion that terminates the named daemon. Because the condition can be reached by resolving queries that the resolver processes with QNAME minimization enabled, remote attackers who can send DNS queries to the resolver can trigger the crash without authentication or user interaction.

Root Cause

The root cause is a NULL pointer dereference ([CWE-476]) in the interaction between two independent BIND features: redirect zones and strict QNAME minimization. QNAME minimization sends only the minimum necessary portion of a query name to authoritative servers, altering the resolver's internal state machine. When a redirect zone is also configured, the redirect processing path encounters an uninitialized or unexpected state and fails an internal invariant check, triggering the assertion.

Attack Vector

The attack vector is network-based with low attack complexity and no required privileges or user interaction. An attacker only needs the ability to cause the vulnerable recursive resolver to process a query that activates the redirect zone handling. Repeated exploitation can keep named offline, producing a sustained denial of service for all clients relying on the resolver. The impact is limited to availability; confidentiality and integrity are not affected.

No verified public exploit code is available. See the ISC CVE-2026-96888 Documentation for the vendor's technical description.

Detection Methods for CVE-2026-96888

Indicators of Compromise

Unexpected named process termination with assertion failure messages in BIND logs.
Log entries referencing redirect zone processing immediately preceding a crash.
Repeated named restarts by service managers such as systemd without an operator action.

Detection Strategies

Review BIND configuration files for the simultaneous presence of a type redirect zone and qname-minimization strict under options.
Correlate DNS resolver crash events with upstream query patterns to identify triggering queries.
Monitor DNS availability metrics for recursive resolvers and alert on sudden drops in query response rates.

Monitoring Recommendations

Forward named logs to a centralized logging platform and alert on assertion failure strings.
Track named process uptime and restart counts through host monitoring agents.
Watch for sustained spikes in SERVFAIL responses or client retransmissions that indicate resolver instability.

How to Mitigate CVE-2026-96888

Immediate Actions Required

Inventory all BIND 9 instances and identify versions in the affected ranges.
Upgrade affected resolvers to BIND 9.20.30 or BIND 9.21.27, or apply the equivalent subscription edition release from ISC.
Restrict recursive resolver access to trusted client networks using ACLs until patches are deployed.

Patch Information

ISC has released fixed versions of BIND 9. Operators should upgrade to the patched builds referenced in the ISC CVE-2026-96888 Documentation. Patched releases include BIND 9.20.30 and 9.21.27, with corresponding fixes shipped in the supported -S1 subscription branches.

Workarounds

Remove the redirect zone from the resolver configuration if it is not operationally required.
Change qname-minimization from strict to relaxed to avoid the vulnerable code path.
Limit recursion to authenticated internal clients using allow-recursion ACLs to reduce exposure.

bash

# Configuration example: switch from strict to relaxed QNAME minimization
options {
    qname-minimization relaxed;
    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
};