CVE-2026-97313: BIND DNS Server DoS Vulnerability

CVE-2026-97313 Overview

CVE-2026-97313 is a denial-of-service vulnerability in ISC BIND 9 recursive name servers. A recursive BIND server that first receives a query with recursion desired (RD=1), followed by a non-recursive query (RD=0), can exit with an assertion failure. The condition requires at least two Response Policy Zones (RPZ) configured with mismatched recursive-only settings. Exploitation terminates the named process and interrupts DNS resolution services. The flaw is categorized under [CWE-617] Reachable Assertion.

Critical Impact
Remote unauthenticated attackers can crash recursive BIND resolvers over the network, disrupting DNS resolution for all downstream clients.

Affected Products

BIND 9 versions 9.16.0 through 9.18.50
BIND 9 versions 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26
BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1

Discovery Timeline

2026-10-21 - CVE-2026-97313 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-97313

Vulnerability Analysis

The vulnerability affects BIND 9 recursive resolvers that use Response Policy Zones (RPZ) for DNS filtering. RPZ enables administrators to override responses for specific domains, typically to block malicious content. Each RPZ zone has a recursive-only setting that controls whether the policy applies to recursive queries only or to all queries.

When a vulnerable server is configured with at least two RPZ zones — one using the default recursive-only yes and another using recursive-only no — the query processing path contains an internal state assumption that can be violated. A query with the recursion desired flag set (RD=1), immediately followed by a non-recursive query (RD=0), triggers an assertion failure inside named. The process exits, causing a denial of service.

Root Cause

The root cause is a reachable assertion [CWE-617] in BIND's RPZ query processing logic. The code assumes a consistent relationship between the RPZ policy applicability and the recursion flag on sequential queries. Mixed recursive-only policies across multiple RPZ zones break that assumption, and the assertion check terminates the daemon rather than handling the state gracefully.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker only needs network access to the recursive resolver and the ability to send two crafted DNS queries in sequence. Because recursive resolvers are typically exposed to internal networks and sometimes the public internet, the attack surface is broad wherever the vulnerable RPZ configuration is deployed.

No public proof-of-concept exploit code has been published. Technical details are available in the ISC CVE-2026-97313 Documentation.

Detection Methods for CVE-2026-97313

Indicators of Compromise

Unexpected termination of the named process with an assertion failure logged in BIND diagnostic output.
Repeated DNS resolution failures reported by downstream clients coinciding with resolver restarts.
Query logs showing paired RD=1 and RD=0 queries from the same source immediately preceding a crash.

Detection Strategies

Inspect named logs for messages containing assertion failure or RUNTIME_CHECK entries from RPZ-related source files.
Audit named.conf for the presence of multiple response-policy zones with differing recursive-only settings.
Correlate process-exit events on DNS servers with inbound query patterns to identify triggering traffic.

Monitoring Recommendations

Enable BIND query logging and ship logs to a centralized SIEM for anomaly detection on resolver restarts.
Monitor service availability of named with health checks that alert on unexpected termination.
Track DNS query failure rates per client subnet to identify abuse patterns targeting the resolver.

How to Mitigate CVE-2026-97313

Immediate Actions Required

Upgrade BIND 9 to a patched release listed in the ISC advisory as soon as operationally feasible.
Review all response-policy configurations and identify servers running vulnerable versions with mixed recursive-only zones.
Restrict recursive query access to trusted client networks using allow-recursion to reduce exposure.

Patch Information

ISC has released fixed versions. Upgrade to BIND 9.20.30 or BIND 9.21.27, or the corresponding Supported Preview Edition. Refer to the ISC CVE-2026-97313 Documentation for the complete list of patched releases.

Workarounds

Configure all response-policy zones with the same recursive-only value until patching is complete.
Disable the second RPZ zone that uses recursive-only no if operationally acceptable.
Limit resolver reachability with firewall rules or allow-query directives to trusted sources only.

bash

# Example: enforce consistent recursive-only setting across RPZ zones in named.conf
response-policy {
    zone "rpz.block.example"  policy given recursive-only yes;
    zone "rpz.custom.example" policy given recursive-only yes;
};

# Restrict recursion to trusted networks
acl trusted { 10.0.0.0/8; 192.168.0.0/16; };
options {
    allow-recursion { trusted; };
};