CVE-2026-96888 — Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

CVE-2026-96888

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization PUBLISHED

Description (CNA)

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Affected (CNA)

Vendor / product	Versions
ISC / BIND 9	affected 9.16.0 through 9.18.50; affected 9.20.0 through 9.20.29; affected 9.21.0 through 9.21.26; affected 9.16.8-S1 through 9.18.50-S1; affected 9.20.9-S1 through 9.20.29-S1

CWE

CWE-476, CWE-617

References

https://kb.isc.org/docs/cve-2026-96888
https://downloads.isc.org/isc/bind9/9.20.30
https://downloads.isc.org/isc/bind9/9.21.27

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.