Vulnerability in ISC BIND 9

[ Description ]Official description

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

[ Fixes ]Fixes and patches

• Security bulletin: ISC BIND cve-2026-94300Vendor patch or bulletin · CERT-FR · kb.isc.org/v1/docs/cve-2026-94300, cited by CERT-FR CERTFR-2026-AVI-1365
• Security bulletin: ISC BIND cve-2026-96888Vendor patch or bulletin · CERT-FR · kb.isc.org/v1/docs/cve-2026-96888, cited by CERT-FR CERTFR-2026-AVI-1365
• Security bulletin: ISC BIND cve-2026-97313Vendor patch or bulletin · CERT-FR · kb.isc.org/v1/docs/cve-2026-97313, cited by CERT-FR CERTFR-2026-AVI-1365

[ Advisories ]Government CERT advisories

• CERT-FR22 Oct 2026CERTFR-2026-AVI-1365

  Multiple vulnerabilities in ISC BIND Translated from French

  Multiple vulnerabilities have been discovered in ISC BIND. They allow an attacker to cause remote arbitrary code execution and remote denial of service.

  CVE-2026-94300CVE-2026-96888CVE-2026-97313
• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4116

  Internet Systems Consortium BIND: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-94300CVE-2026-97313CVE-2026-96888+1 more CVEs

[ References ]References

• downloads.isc.org/isc/bind9/9.20.30
• downloads.isc.org/isc/bind9/9.21.27
• kb.isc.org/docs/cve-2026-96888