Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.
ISC DHCP is not affected. CVE-2026-96888 is a denial of service in the BIND name server (named): an assertion failure when a recursive resolver configured with a "redirect" zone and "qname-minimization strict" processes an NXDOMAIN response. The upstream fix (isc-projects/bind9 commit ede8392, "Handle qname-minimization failures gracefully when redirecting") only modifies redirect() and redirect2() in lib/ns/query.c, which is named's server-side query processing and is not part of the libraries bundled in ISC DHCP. ISC DHCP bundles only parts of the BIND 9.11.14 libraries (libisc, libdns, libisccfg, libirs). It uses them for DDNS (TSIG, DNS message construction and parsing, DHCID), OMAPI, and basic functions (configuration handling, data structures, logging, networking primitives). The bundled 9.11 code has no lib/ns, and QNAME minimization (introduced in BIND 9.14) is not present in it. DHCP does not implement a DNS resolver or server, does not configure redirect zones, and does not process recursive queries.