CVE-2026-97313 Internet Systems Consortium CVE debrief

Who should care

Defenders responsible for BIND 9 servers, particularly those allowing recursive queries and having RPZ zones configured, should assess exposure and prioritize updates to patched versions. This includes verifying BIND 9 configurations to ensure they align with recommended settings and monitoring BIND 9 logs for potential query patterns that may cause issues.

Why it matters

Defenders should prioritize verifying BIND 9 configurations and updating to patched versions to prevent potential denial of service due to specific query patterns.

• Potential denial of service due to unexpected server exit.
• Need to verify BIND 9 configurations and update to patched versions.

Technical summary

A recursive BIND 9 server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of 'recursive-only yes', and the other with 'recursive-only no'. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Defensive priority

Defenders should prioritize verifying BIND 9 configurations and updating to patched versions to prevent potential denial of service.

Recommended defensive actions

• Verify BIND 9 configurations to ensure they align with recommended settings.
• Update BIND 9 to a patched version (9.20.30 or later, 9.21.27 or later).
• Monitor BIND 9 logs for potential query patterns that may cause issues.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1, and potential query patterns that may cause the issue. The source details indicate that at least two RPZ zones must be configured: one with the default setting of 'recursive-only yes', and the other with 'recursive-only no'.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.