Vulnerability in ISC BIND 9

[ Description ]Official description

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

[ Fixes ]Fixes and patches

• Security bulletin: ISC BIND cve-2026-94300Vendor patch or bulletin · CERT-FR · kb.isc.org/v1/docs/cve-2026-94300, cited by CERT-FR CERTFR-2026-AVI-1365
• Security bulletin: ISC BIND cve-2026-96888Vendor patch or bulletin · CERT-FR · kb.isc.org/v1/docs/cve-2026-96888, cited by CERT-FR CERTFR-2026-AVI-1365
• Security bulletin: ISC BIND cve-2026-97313Vendor patch or bulletin · CERT-FR · kb.isc.org/v1/docs/cve-2026-97313, cited by CERT-FR CERTFR-2026-AVI-1365

[ Advisories ]Government CERT advisories

• CERT-FR22 Oct 2026CERTFR-2026-AVI-1365

  Multiple vulnerabilities in ISC BIND Translated from French

  Multiple vulnerabilities have been discovered in ISC BIND. They allow an attacker to cause remote arbitrary code execution and remote denial of service.

  CVE-2026-94300CVE-2026-96888CVE-2026-97313
• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4116

  Internet Systems Consortium BIND: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-94300CVE-2026-97313CVE-2026-96888+1 more CVEs

[ References ]References

• downloads.isc.org/isc/bind9/9.20.30
• downloads.isc.org/isc/bind9/9.21.27
• kb.isc.org/docs/cve-2026-97313