Bug 2556415 (CVE-2026-97313) - CVE-2026-97313 bind: bind: Denial of service via assertion failure in RPZ query processing
Summary: CVE-2026-97313 bind: bind: Denial of service via assertion failure in RPZ que...
Keywords:
Status: NEW
Alias: CVE-2026-97313
Deadline: 2026-10-21
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2558426 2558427
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-20 19:59 UTC by OSIDB Bzimport
Modified: 2026-10-21 18:01 UTC (History)
18 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-20 19:59:37 UTC 
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
Note You need to log in before you can comment on or make changes to this bug.