CVE-2026-97313 Specific RPZ configurations and query patterns may result in an unexpected exit
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-97313?
CVE-2026-97313 is a high-severity vulnerability in ISC BIND 9, published on 21 Oct 2026.
Official description
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Weakness: CWE-617
Which versions are affected by CVE-2026-97313?
How do I fix CVE-2026-97313?
Upgrade to a fixed version.
Is CVE-2026-97313 being exploited?
There is no known exploitation of CVE-2026-97313 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-97313, AZL-111515, BELL-CVE-2026-97313, DEBIAN-CVE-2026-97313, ECHO-e208-e869-5e59, GHSA-9p2q-wv22-f9q8 and 2 more.