CVE-2026-97313

A flaw was found in BIND. A remote attacker can cause a denial of service (DoS) by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones (RPZ) with differing recursion settings, processing these queries triggers an assertion failure. This failure causes the service to crash and terminate abruptly.

Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can crash the BIND name service, causing a denial of service for all dependent infrastructure. Exploitation requires a specific, non-default deployment where recursive queries are permitted alongside multiple response policy zones configured with conflicting recursive-only options. Default Red Hat Enterprise Linux configurations do not define response policy zones and are therefore not exposed unless administrators have explicitly implemented this combination of policies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure all Response Policy Zones (RPZ) configured in /etc/named.conf use identical recursive-only settings. For example, ensure all RPZ definitions consistently specify recursive-only yes; or recursive-only no;, eliminating conflicting policies.

Alternatively, limit recursive query privileges strictly to authorized clients by configuring the allow-recursion option with an access control list (ACL).

After modifying the configuration, validate the syntax and reload the service:

named-checkconf
systemctl reload named

Caveats: Aligning the recursive-only setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups.

Warning: Reloading or restarting the named service may cause a momentary pause in active DNS query processing.