CVE-2026-96888

What it actually does

A BIND resolver configured with both a redirect zone and qname-minimization strict aborts with an assertion failure during redirect processing, resulting in a crash.

Why it matters to the business

DNS resolution services become unavailable until the resolver restarts, causing outages for dependent applications and users; the recent publication and specific Red Hat advisory increase urgency for patching despite low exploitation probability.

How an attack unfolds

An attacker sends a DNS query that triggers the redirect zone handling under strict qname-minimization, causing the assertion failure and crash without requiring authentication or special privileges.

How to fix it

Upgrade affected BIND 9 installations to the fixed versions listed in the advisory, specifically bind-main (redhat) to 9.20.30-0.1.hum1 or later via RHSA-2026:87309; disable qname-minimization strict or redirect zones as a temporary mitigation if upgrade is delayed.

How to confirm the fix worked

Confirm the running BIND version is outside the vulnerable ranges (9.16.0-9.18.50, 9.20.0-9.20.29, etc.) and test that queries involving redirect zones no longer cause crashes under strict qname-minimization.

Typical attack path

1. Identify a publicly reachable BIND resolver with redirect zones and qname-minimization strict enabled
2. Craft and send a DNS query that exercises the redirect path
3. Trigger the assertion failure leading to process abort

How to detect it

Review BIND logs for assertion failure messages related to redirect processing and qname-minimization; correlate with unusual query patterns from external sources.

What your security team should do

• Apply the Red Hat update to 9.20.30-0.1.hum1 immediately given the four-day publication window
• Audit resolver configurations for simultaneous use of redirect zones and qname-minimization strict
• Monitor DNS service availability and logs for assertion failures during the remediation window