Welcome To openEuler Community
Hey @tangce2025 , thanks for your contribution to the community.
Bot Usage Manual
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands. You can self-configure the PR merge rules for this repository. For more details, please refer to Here.
Contact Guide
If you have any questions, please contact the SIG: Networking ,
and any of the maintainers: @Apricity_HW, @MrRlu, @robert-xingwang, @sunsuwan ,
and any of the committers: @jiangheng12138, @zhongxuan2 .
/branches openEuler-24.03-LTS-SP4
【任务 #181 · openEuler-24.03-LTS-SP4】bundle CVE-2026-97313+CVE-2026-96888
─── CVE-2026-97313 ───
是否受影响：不受影响
CVE-2026-97313 的自有补丁经 Step 4 源码影响性分析判为 NOT_APPLICABLE，漏洞代码不存在于本版本源码，无需修复。
- openEuler-24.03-LTS-SP4（9.20.21）：不受影响
修复补丁：https://github.com/isc-projects/bind9/commit/1952a2eee638826ab811cf89937502aa305fedf0.patch
补丁适配情况：无需适配，无前置补丁。
- [原补丁] backport-CVE-2026-97313-3.patch：干净应用（applied_clean，置信度 high），无冲突项。
PR 提交情况：无 PR。
──────── 复制以下内容回填 issue ────────
受影响版本排查(受影响/不受影响)：
1.openEuler-24.03-LTS-SP4(9.20.21): 不受影响
ABI 变化：否
原因说明：
1.不受影响-漏洞代码不存在
────────────────────────────────────────
─── CVE-2026-96888 ───
是否受影响：受影响
配置 redirect zone 且启用 qname-minimization strict 的 BIND resolver 在处理 redirect 时可能因断言失败而中止（拒绝服务）。Step 4 源码影响性分析判定补丁 APPLICABLE：补丁仅修改 lib/ns/query.c，5 个 hunk 全部位于漏洞路径函数 redirect()（query.c:5176）与 redirect2()（query.c:5306）内，全部上下文行与源码逐行一致（仅 +214~+225 行的整体行号偏移），依赖符号均存在，漏洞模式（*dbp 无 NULL 检查、foundname 未初始化）在本版本源码中完整在位，需要修复。
- openEuler-24.03-LTS-SP4（9.20.21）：受影响
修复补丁：https://github.com/isc-projects/bind9/commit/794fa3850184de3ef09b0a14a4bf067f6a383fc4.patch
补丁适配情况：无需适配，无前置补丁。
- [原补丁] backport-CVE-2026-96888-1.patch：干净应用（applied_clean，置信度 high），无冲突项。
- [原补丁] backport-CVE-2026-96888-2.patch：干净应用（applied_clean，置信度 high），无冲突项。
PR 提交情况：
- openEuler-24.03-LTS-SP4：https://gitcode.com/src-openeuler/bind/merge_requests/379
──────── 复制以下内容回填 issue ────────
受影响版本排查(受影响/不受影响)：
1.openEuler-24.03-LTS-SP4(9.20.21): 受影响
ABI 变化：否
原因说明：
1.正常修复
────────────────────────────────────────
合并修复 PR（bundle）：https://gitcode.com/src-openeuler/bind/merge_requests/379
/close
Notice
@tangce2025 , this issue is linked to an open PR. Please merge the PR before closing this issue.
/close
1.漏洞编号：CVE-2026-97313
漏洞归属组件：bind
漏洞归属的版本：9.11.21,9.16.23,9.16.37,9.18.21,9.18.33,9.20.21
CVSS评分：
BaseScore：7.5 HIGH
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of recursive-only yes , and the other with recursive-only no .This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
漏洞公开时间：2026-10-21 21:21:09
漏洞创建时间：2026-10-22 15:20:16
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-97313
2.漏洞编号：CVE-2026-96888
漏洞归属组件：bind
漏洞归属的版本：9.11.21,9.16.23,9.16.37,9.18.21,9.18.33,9.20.21
CVSS评分：
BaseScore：7.5 HIGH
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
A BIND resolver that is configured with both a redirect zone and qname-minimization strict may abort with an assertion failure while processing the redirect.This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
漏洞公开时间：2026-10-21 21:21:08
漏洞创建时间：2026-10-22 15:18:57
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-96888