Bug 2558426 - CVE-2026-97313 dhcp: bind: Denial of service via assertion failure in RPZ query processing [fedora-all]
Summary: CVE-2026-97313 dhcp: bind: Denial of service via assertion failure in RPZ que...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: dhcp
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Martin Osvald 🛹
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["d662a4c9-d5ae-498e-8c95-9...
Depends On:
Blocks: CVE-2026-97313
TreeView+ depends on / blocked
 
Reported: 2026-10-21 18:00 UTC by Marco Benatto
Modified: 2026-10-21 18:00 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Marco Benatto 2026-10-21 18:00:58 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".


Note You need to log in before you can comment on or make changes to this bug.