7.5

CVE-2026-96888: Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

Awaiting analysis
AliasesDEBIAN-CVE-2026-96888UBUNTU-CVE-2026-96888ALPINE-CVE-2026-96888
Published 21-10-2026Last modified 21-10-2026

Vulnerability summary

CVE-2026-96888 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in isc bind 9. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.46%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 2
MGASA-2026-0541OPENSUSE-SU-2026:12231-1USN-8969-1

Timeline

  1. 21-10-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

22-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard7 products
  • bindAll versions (No fix recorded)
  • bind-devAll versions (No fix recorded)
  • bind-dnssec-rootAll versions (No fix recorded)
  • bind-dnssec-toolsAll versions (No fix recorded)
  • bind-libsAll versions (No fix recorded)
Wolfi7 products
  • bindAll versions (No fix recorded)
  • bind-devAll versions (No fix recorded)
  • bind-dnssec-rootAll versions (No fix recorded)
  • bind-dnssec-toolsAll versions (No fix recorded)
  • bind-libsAll versions (No fix recorded)
Ubuntu3 products
  • bind9All versions (No fix recorded) | < 1:9.18.39-0ubuntu0.22.04.8 | < 1:9.18.39-0ubuntu0.24.04.9 | < 1:9.20.24-1ubuntu3.1 | < 1:9.20.24-1ubuntu0.5
  • bind9-libsAll versions (No fix recorded)
  • isc-dhcpAll versions (No fix recorded)
Alpine1 product
  • bind< 9.20.30-r0
Debian1 product
  • bind9All versions (No fix recorded) | < 1:9.20.30-1~deb13u1 | < 1:9.20.30-1
Isc1 product
  • bind 9≥ 9.16.0, ≤ 9.18.50 | ≥ 9.20.0, ≤ 9.20.29 | ≥ 9.21.0, ≤ 9.21.26 | ≥ 9.16.8-S1, ≤ 9.18.50-S1 | ≥ 9.20.9-S1, ≤ 9.20.29-S1

6 vendors · 20 products

References

8 links