Closing the configuration gap after CVE-2026-96888

CVE-2026-96888 affects BIND resolvers processing NXDOMAIN responses when redirect zones and strict QNAME minimization are both configured. This vulnerability causes an assertion failure and termination of named, leading to a denial-of-service impact. ISC rates the issue as High with a CVSS 3.1 score of 7.5. Fixed releases include 9.20.30, 9.21.27, and 9.20.30-S1. Because the trigger remains reachable after recovery, repeated aborts on critical resolvers require a structured response and configuration baseline updates.