EUVD-2026-107256
GHSA-9p2q-wv22-f9q8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach recursive BIND resolver over DNS
-
DeliverySend RD=1 query
-
ExploitFollow with RD=0 query
-
ExecutionTrigger RPZ assertion failure
-
Impactnamed process aborts (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires the BIND 9 server to (1) permit recursive queries and (2) have at least two Response Policy Zones (RPZ) configured simultaneously - one left at the default 'recursive-only yes' and another explicitly set to 'recursive-only no'. The trigger is a specific query sequence: a recursion-desired (RD=1) query followed by a non-recursive (RD=0) query. Limiting factors: RPZ is not enabled by default and the precise mixed 'recursive-only' setting across two zones is an uncommon configuration, so default or single-policy deployments are not affected; no authentication is needed, but the attacker must be able to send queries to the recursive service (networks restricting recursion to trusted clients reduce exposure). |
| Impact | This is a genuine but conditionally-gated availability issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes a remote, unauthenticated, low-complexity crash with high availability impact and no confidentiality/integrity impact - consistent with the CWE-617 assertion failure (REQUIRE/INSIST abort) in the description. However, the real-world risk is substantially lower than the 7.5 suggests because exploitation is gated on a specific, non-default RPZ configuration (two RPZ zones, one 'recursive-only yes' and one 'recursive-only no') on a recursive-capable server; CVSS AC:L does not account for this deployment prerequisite, so defenders should treat the effective exploitability as narrower than the base vector implies. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit referenced, so the status is no public exploit identified at time of analysis. Net: a real patch-worthy DoS for the subset of operators running the specific RPZ combination, but not a mass-exploitation emergency, and signals are limited (no EPSS, no POC, no KEV). |
| Exploit ScenarioDerived | An attacker who can send DNS queries to a vulnerable recursive BIND server configured with the specific dual-RPZ setup sends a query with recursion desired (RD=1) immediately followed by a non-recursive query (RD=0), triggering an assertion failure that terminates named. Repeating this crashes the resolver on demand, denying DNS service to all downstream clients. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote unauthenticated denial of service in BIND 9 recursive resolvers can be triggered by a crafted query sequence when at least two RPZ zones are configured with conflicting recursive-only settings. The issue affects BIND 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and corresponding -S1 subscription releases, causing an assertion failure and server exit when an RD=1 query is followed by an RD=0 query. ISC advisories reference fixed releases 9.20.30 and 9.21.27; no public exploit code or CISA KEV entry was identified at time of analysis, and exposure is limited to recursive servers with the uncommon mixed-RPZ configuration.
RemediationAI
Upgrade to BIND 9.20.30 or 9.21.27, or later, as referenced by ISC's download links, and follow https://kb.isc.org/docs/cve-2026-97313 for branch-specific guidance, including the 9.18 and -S1 subscription branches. If upgrading cannot be done immediately, eliminate the trigger by making recursive-only consistent across all RPZ zones or by removing RPZ zones that are not required; this avoids the assertion but may change DNS policy enforcement. Alternatively, disable recursion or restrict it to trusted clients with allow-recursion and allow-query ACLs, which reduces exposure but breaks resolver service for untrusted networks and may affect legitimate clients. The provided references identify 9.20.30 and 9.21.27 as fixed releases; confirm the corresponding 9.18 and -S1 fixes in the ISC advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BIND 9 is a widely deployed DNS server, and its recursive resolver can apply Response Policy Zones (RPZ) to rewrite or block DNS answers according to policy. The RPZ recursive-only option controls whether a zone is applied only to recursive queries (the default, recursive-only yes) or also to non-recursive queries (recursive-only no). When two RPZ zones have different recursive-only settings, processing a recursion-desired (RD=1) query followed by a non-recursive (RD=0) query can place the resolver in a state that violates an internal assertion, causing the named process to abort. This is a CWE-617 reachable assertion leading to availability loss. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms a network-reachable, unauthenticated availability impact with no confidentiality or integrity effect. RPZ is not enabled by default, and the mixed recursive-only configuration across two zones is uncommon, so default or single-policy deployments are not exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated query sequence crashes named with low complexity once the vulnerable RPZ config exists; availability-only impact, no confidentiality or integrity effect.
Primary rating from Vendor (isc).
CVSS VectorVendor: isc
DescriptionCVE.org
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Executive ViewAI
BIND 9 recursive resolvers configured with at least two RPZ zones using conflicting recursive-only settings can be forced to exit by a crafted query sequence, causing DNS resolution outages for dependent users and applications. Leadership should care because DNS is a foundational service, and while the triggering configuration is uncommon, any affected resolver poses a direct availability risk to business operations. No public exploit identified at time of analysis, but the vulnerability is high severity and fixed releases are referenced by ISC.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB