BIND Recursion Assertion Failure (DoS) 9.169.18.50, 9.209.20.29, 9.219.21.26
CVE-2026-97313 Published on October 21, 2026
Specific RPZ configurations and query patterns may result in an unexpected exit
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Vulnerability Analysis
CVE-2026-97313 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is an assertion failure Vulnerability?
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVE-2026-97313 has been classified to as an assertion failure vulnerability or weakness.
Products Associated with CVE-2026-97313
Want to know whenever a new CVE is published for ISC BIND? stack.watch will email you.
Affected Versions
ISC BIND 9:- Version 9.16.0, <= 9.18.50 is affected.
- Version 9.20.0, <= 9.20.29 is affected.
- Version 9.21.0, <= 9.21.26 is affected.
- Version 9.11.3-S1, <= 9.18.50-S1 is affected.
- Version 9.20.9-S1, <= 9.20.29-S1 is affected.