CVE-2026-97313

What it actually does

Assertion failure causing BIND server crash when a recursive query (RD=1) is followed by a non-recursive query (RD=0) on servers allowing recursion with at least two RPZ zones configured as recursive-only yes and recursive-only no.

Why it matters to the business

Causes denial of service for DNS resolution, leading to outages for applications and services that rely on the server until restart or recovery, with elevated risk due to publication only 5 days ago.

How an attack unfolds

An unauthenticated remote attacker identifies a vulnerable recursive BIND server with the required dual-RPZ configuration and sends a sequence of queries with RD=1 followed by RD=0 to trigger the assertion failure and crash the server.

How to fix it

Upgrade affected bind-main packages to the fixed version 9.20.30-0.1.hum1 (per RHSA-2026:87309) or later; review and adjust RPZ zone configurations if recursion must remain enabled.

How to confirm the fix worked

Confirm BIND version meets or exceeds the fixed release; replay the RD=1 then RD=0 query sequence in a test environment and verify absence of assertion failures in logs.

Typical attack path

1. Scan for exposed recursive BIND servers with multiple RPZ zones
2. Send query with recursion desired (RD=1)
3. Immediately follow with query without recursion desired (RD=0)
4. Observe server crash and resulting denial of service

How to detect it

Review BIND query and error logs for assertion failures tied to RPZ processing; correlate with unexpected named process restarts or service outages following mixed RD query patterns.

What your security team should do

• Apply the vendor patch within the next 48 hours given the 5-day publication window
• Temporarily disable recursion or consolidate RPZ zones as a compensating control
• Add monitoring for unexpected BIND process terminations and assertion errors