Bug 2558423

Summary:	CVE-2026-96888 dhcp: bind: Denial of Service via assertion failure during redirect processing [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Marco Benatto <mbenatto>
Component:	dhcp	Assignee:	Martin Osvald 🛹 <mosvald>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	fhrdina, jorton, mosvald, pavel, pemensik
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["5b8e6bf3-0d85-4861-9352-f2f68c1680e0"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-22 07:47:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2556413

Description Marco Benatto 2026-10-21 17:59:59 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.

Comment 1 Martin Osvald 🛹 2026-10-22 07:47:21 UTC

ISC DHCP is not affected.

CVE-2026-96888 is a denial of service in the BIND name server (named): an assertion failure when
a recursive resolver configured with a "redirect" zone and "qname-minimization strict" processes
an NXDOMAIN response. The upstream fix (isc-projects/bind9 commit ede8392, "Handle
qname-minimization failures gracefully when redirecting") only modifies redirect() and
redirect2() in lib/ns/query.c, which is named's server-side query processing and is not part of
the libraries bundled in ISC DHCP.

ISC DHCP bundles only parts of the BIND 9.11.14 libraries (libisc, libdns, libisccfg, libirs).
It uses them for DDNS (TSIG, DNS message construction and parsing, DHCID), OMAPI, and basic
functions (configuration handling, data structures, logging, networking primitives). The bundled
9.11 code has no lib/ns, and QNAME minimization (introduced in BIND 9.14) is not present in it.
DHCP does not implement a DNS resolver or server, does not configure redirect zones, and does
not process recursive queries.