EUVD-2026-107255
GHSA-4x52-cj5p-p824
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted recursive DNS query to resolver
-
ExploitResolver processes redirect zone under qname-minimization strict
-
ExecutionHit NULL pointer dereference / assertion failure
-
Impactnamed process aborts, DNS resolution denied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target BIND 9 resolver to be configured with BOTH a 'redirect' zone AND 'qname-minimization strict' at the same time - this exact, non-default configuration combination is the mandatory prerequisite named in the vendor description. A resolver missing either setting is not affected. When the configuration is present, the attacker needs only to send recursive queries that cause the redirect to be processed (AV:N, PR:N, UI:N) - no authentication or user interaction. The dominant limiting factor is that this specific dual-configuration is operator-chosen and uncommon, not a default deployment, which sharply narrows the realistic exposed population. Only affects BIND 9 versions 9.16.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26, and the corresponding -S1 supported-preview builds. |
| Impact | All quantitative exploitation signals point to a LOW real-world priority despite the HIGH 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a remotely reachable, unauthenticated, availability-only impact (NULL pointer dereference / assertion failure causing the resolver to abort). There is no KEV listing (not confirmed actively exploited), no public exploit identified at time of analysis, and no EPSS value was provided in the input - so there is no evidence of in-the-wild or widespread exploitation. The single most important mitigating factor is the narrow trigger condition: the resolver must be simultaneously configured with BOTH a 'redirect' zone AND 'qname-minimization strict', which is a non-default, operator-chosen combination. The CVSS AC:L metric therefore understates real-world difficulty because it does not account for this uncommon configuration prerequisite - the base score assumes the vulnerable configuration is already present. Net assessment: a genuine denial-of-service bug in ubiquitous DNS software, worth patching promptly on any resolver using that specific configuration, but it is a high-CVSS / low-likelihood issue for the general population rather than a drop-everything emergency. No confidentiality or integrity impact exists. |
| Exploit ScenarioDerived | An attacker who can send recursive DNS queries to a BIND 9 resolver that has been configured with both a 'redirect' zone and 'qname-minimization strict' sends a query that causes the resolver to process the redirect, triggering an assertion failure that aborts the named process. Repeated queries keep the resolver offline, denying DNS resolution to all downstream clients. No authentication or user interaction is required once the vulnerable configuration is in place, but no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Assertion failure and null-pointer abort in ISC BIND 9 recursive resolvers terminate the named process, denying DNS resolution to every downstream client until the service is restarted. Only resolvers configured with BOTH a 'redirect' zone AND 'qname-minimization strict' are affected - a non-default, operator-chosen combination that sharply narrows the realistically exposed population, so despite the 7.5 CVSS base score all qualitative signals point to a low real-world priority. The trigger is unauthenticated and remote (PR:N/AV:N, no user interaction), but no public exploit identified at time of analysis and no active exploitation has been reported; vendor fixes are published as 9.20.30 and 9.21.27.
RemediationAI
Vendor-released patches: upgrade to BIND 9.20.30 (https://downloads.isc.org/isc/bind9/9.20.30) or 9.21.27 (https://downloads.isc.org/isc/bind9/9.21.27); operators on the 9.16/9.18 branches should confirm the branch-specific fixed build in the advisory at https://kb.isc.org/docs/cve-2026-96888, since the 9.16 line is past end-of-life and the durable answer there is migration to a supported branch. If an immediate upgrade is not possible, break the prerequisite configuration instead: remove the 'redirect' zone clause from named.conf so the affected code path is never reached (trade-off: any DNS-filtering or name-redirection behavior that zone provided is lost and those names resolve normally), or switch 'qname-minimization' from strict to relaxed or off (trade-off: reduced query-name privacy per RFC 9156 and a larger volume of full-name queries leaked to authoritative servers). Because the failure mode is a process abort, add a supervised restart (systemd Restart=on-failure or equivalent) and alerting on named assertion/abort log lines as a containment measure, though this only shortens outage duration and does not prevent recurrence. Restrict recursion to trusted client ranges (allow-recursion/allow-query) as a general hardening step; it does not eliminate the flaw but shrinks the set of hosts able to supply the triggering queries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BIND 9 is ISC's reference DNS implementation, deployed both as an authoritative server and as a recursive/caching resolver; this defect lives in the resolver path. QNAME minimization (RFC 9156) is a privacy feature that sends only the minimal label of a query to each authoritative server in the delegation chain; in 'strict' mode the resolver enforces minimization unconditionally rather than falling back when a server misbehaves. A 'redirect' zone is a BIND zone type that synthesizes answers (commonly used to hijack or redirect blocked names) instead of resolving them normally. Per CWE-476 (NULL Pointer Dereference), the interaction between the redirect zone's synthesized-response handling and strict minimization's iteration logic leaves a null structure that is dereferenced, tripping an assertion and aborting the resolver process. The CVSS vector (S:U, C:N/I:N/A:H) confirms this is a fail-stop availability impact only: there is no memory corruption primitive, no data disclosure, and no integrity impact, so the practical risk is service outage rather than host compromise. Exploitation requires only that the target already be configured with both settings; denying service thereafter takes nothing more than ordinary recursive queries that route through the redirect.
Know when Bind 9 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable unauthenticated query triggers an abort (AV:N/PR:N/UI:N); availability-only with no data impact (C:N/I:N/A:H); config prerequisite is a deployment precondition, not an attacker-side hurdle, so AC:L.
Primary rating from Vendor (isc).
CVSS VectorVendor: isc
DescriptionCVE.org
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Executive ViewAI
A denial-of-service condition in ISC BIND 9 can take affected recursive resolvers offline, interrupting DNS resolution for downstream users and applications until the service is restarted. Exposure is limited to the non-default combination of a redirect zone and strict QNAME minimization, and no public exploit identified at time of analysis, so leadership should prioritize targeted validation and patching over broad emergency action.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling
Memory corruption in ISC BIND 9's GSS-TSIG handling allows an on-path attacker who captures a previously signed UDP mess
Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.2
Exploit-DB