CVE-2026-96888

Public on 2026-10-21

Modified on 2026-10-21

Description

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization (CWE-617). A resolver is only affected when configured with both a redirect zone AND qname-minimization strict. Affected versions: 9.16.0–9.18.50, 9.20.0–9.20.29, 9.21.0–9.21.26.

Severity

Important

See what this means

CVSS v3 Base Score

7.5

See breakdown

Affected Packages

Platform	Package	Status
Amazon Linux 2 - Core	bind	Not Affected
Amazon Linux 2023	bind	Pending Fix
Amazon Linux 2027 Preview	bind	Pending Fix

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-96888 Mitre: CVE-2026-96888