High 7.5Published Oct 21, 2026

CVE-2026-96888Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

Updated under an hour ago (Oct 27, 2026, 5:00 AM ET)

Does this affect you?

It affects ISC BIND 9. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.46%, higher than 40% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for ISC BIND 9

Exploited in the last 30 days

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476, CWE-617
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.46% (percentile 40)
Assigned by: isc
NVD analysis: Awaiting Analysis
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 21, 2026

Affected products

Affected products

ISC BIND 9 isc:bind_9 (from the name)	from 9.16.0 through 9.18.50; from 9.20.0 through 9.20.29; from 9.21.0 through 9.21.26; from 9.16.8-S1 through 9.18.50-S1; from 9.20.9-S1 through 9.20.29-S1	CNA record

References

References

https://kb.isc.org/docs/cve-2026-96888	vendor-advisory
https://downloads.isc.org/isc/bind9/9.20.30	patch
https://downloads.isc.org/isc/bind9/9.21.27	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.