CVE-2026-13204

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof.

This vulnerability is rated as Important because an unauthenticated remote attacker can trigger an abrupt service crash in BIND, resulting in a total denial of service for DNS resolution. In standard Red Hat Enterprise Linux deployments, recursive DNS servers have DNSSEC validation active by default, making them susceptible whenever resolving domains that present contradictory proof records. Systems operating solely as authoritative nameservers without recursion or DNSSEC validation are unaffected by this defect.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.