CVE-2026-97313: CWE-617 Reachable Assertion in ISC BIND 9
Description
CVE-2026-97313 is a high-severity vulnerability in ISC BIND 9 that causes a denial of service via an assertion failure. It occurs when a recursive BIND server receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0), under specific configuration conditions involving RPZ zones. The server must allow recursive queries and have at least two RPZ zones configured with differing "recursive-only" settings. This affects multiple BIND 9 versions ranging from 9.11.3-S1 through 9.21.26 and their respective subversions.
CVSS v3.1
Score 7.5high
Affected software
ISC
BIND 9
pkg:github/isc/bind9Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from a reachable assertion failure in ISC BIND 9 when handling DNS queries with specific recursion flags under certain RPZ zone configurations. The affected BIND server must be configured to allow recursive queries and have at least two RPZ zones: one with "recursive-only yes" and another with "recursive-only no". When a recursive query (RD=1) is followed by a non-recursive query (RD=0), the server may exit unexpectedly, causing a denial of service. The issue impacts BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and the corresponding S1 subversions from 9.11.3-S1 through 9.20.29-S1.
Potential Impact
Successful exploitation results in a denial of service due to the server exiting from an assertion failure. There is no impact on confidentiality or integrity. The vulnerability requires specific server configuration and query patterns to trigger.
Mitigation Recommendations
No vendor advisory or patch information is provided in the data. Patch status is not yet confirmed — check the ISC vendor advisory for current remediation guidance. Until a fix is available, administrators should review their RPZ zone configurations and consider disabling recursive queries or adjusting RPZ settings to avoid the vulnerable condition.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- isc
- Date Reserved
- 2026-09-24T11:09:13.016Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad8bb494d27ba8daaac2d77
Added to database: 10/21/2026, 13:16:57 UTC
Last enriched: 10/21/2026, 13:30:19 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.