Skip to main content

ISC BIND 9 CVE-2026-5946

| EUVDEUVD-2026-31107 HIGH
Improper Input Validation (CWE-20)
2026-05-20 isc GHSA-cqgq-ff3f-rj7r
Denial Of Service Bind 9 Isc
7.5
CVSS 3.1 · Vendor: isc
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify exposed BIND 9 resolver
  2. Delivery
    Craft DNS query with CHAOS/HESIOD/ANY/NONE class
  3. Exploit
    Send to recursion or UPDATE endpoint
  4. Execution
    Trigger assertion failure in named
  5. Impact
    Process terminates causing DNS outage

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

Exploitation requires that the BIND 9 named process expose at least one of the vulnerable code paths to the attacker: recursion enabled and reachable (typical for internal/ISP resolvers), dynamic UPDATE accepted from the attacker's source (typically restricted by allow-update ACL), NOTIFY accepted from the attacker (typically restricted by allow-notify ACL), or processing of IN-specific record types within non-IN zone data. No authentication is required (CVSS PR:N), no user interaction is needed (UI:N), and attack complexity is low (AC:L) - but the practical attack surface depends on deployment: open recursive resolvers are exposed by default, while UPDATE and NOTIFY code paths are reachable only when ACLs permit the attacker's source IP. The vulnerable version must be running (BIND 9.11.0-9.16.50, 9.18.0-9.18.48, 9.20.0-9.20.22, 9.21.0-9.21.21, or the listed S1 builds).
Impact

Real-world risk is meaningful but bounded to availability: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms remote, low-complexity, unauthenticated exploitation reachable over the network, but the impact scope is strictly A:H with C:N/I:N - this is a pure denial-of-service issue, not a path to code execution or data disclosure. The vulnerability is reported by ISC itself (vendor-disclosed) rather than being flagged by CISA KEV, and no public exploit identified at time of analysis. EPSS score was not provided in the input data and cannot be assessed. The risk is elevated by BIND's ubiquity in critical DNS infrastructure - a crashed resolver creates immediate outage - but somewhat mitigated by the fact that multiple specific code paths (recursion, UPDATE, NOTIFY, non-IN record processing) must be reached, and dynamic UPDATE and NOTIFY are typically restricted to trusted sources by configuration. Treat as a high-priority patch for any internet-facing or recursion-enabled BIND deployment.
Exploit ScenarioDerived

An attacker on the internet sends a single crafted DNS query with CLASS set to CHAOS, HESIOD, ANY, or NONE - or a malformed UPDATE/NOTIFY message - toward a publicly reachable BIND 9 recursive resolver, triggering an assertion failure that terminates the named process. Repeated requests during process restart cycles produce sustained DNS outage for downstream clients. No POC is publicly identified at this time, but the trigger is described in sufficient detail in the ISC advisory that exploit development is straightforward.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Remote denial of service in ISC BIND 9 named allows unauthenticated attackers to trigger assertion failures and crash the resolver by sending DNS messages with non-Internet classes (CHAOS, HESIOD) or meta-classes (ANY, NONE) through code paths involving recursion, dynamic UPDATE, NOTIFY, or IN-specific record processing in non-IN data. The flaw affects BIND 9.11.0 through 9.21.21 across both open-source and Supported Preview (S1) branches, with no public exploit identified at time of analysis. CVSS 7.5 reflects high availability impact with network-reachable, low-complexity, unauthenticated exploitation.

RemediationAI

Vendor-released patches are available: upgrade open-source BIND 9 to 9.18.49 (https://downloads.isc.org/isc/bind9/9.18.49), 9.20.23 (https://downloads.isc.org/isc/bind9/9.20.23), or 9.21.22 (https://downloads.isc.org/isc/bind9/9.21.22), and Subscription Edition customers should obtain the corresponding S1 builds from ISC support. Note that the 9.11 and 9.16 branches are end-of-life with no patched open-source release listed - operators still running those branches should plan migration to 9.18.49 or later. Until patching is complete, compensating controls include restricting recursion to trusted clients via the allow-recursion ACL, limiting dynamic UPDATE sources via allow-update or update-policy (trade-off: breaks dynamic DNS clients outside the ACL), restricting NOTIFY sources via allow-notify to known authoritative peers (trade-off: zone transfer coordination must be re-validated), and considering an upstream DNS firewall or rate-limiting layer to drop malformed-class queries before they reach named. Refer to the ISC knowledge base advisory at https://kb.isc.org/docs/cve-2026-5946 for definitive guidance.

Affected VersionsENISA

BIND 9 9.20.9-S1 ≤9.20.22-S1
BIND 9 9.21.0 ≤9.21.21
BIND 9 9.11.3-S1 ≤9.16.50-S1
BIND 9 9.18.0 ≤9.18.48
BIND 9 9.18.11-S1 ≤9.18.48-S1
BIND 9 9.20.0 ≤9.20.22
BIND 9 9.11.0 ≤9.16.50

Affected Packages

euvd bind_9 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

BIND 9 is the most widely deployed DNS server implementation, maintained by ISC and used by recursive resolvers, authoritative nameservers, and DNS infrastructure operators worldwide. The vulnerability stems from CWE-20 (Improper Input Validation) in named's handling of DNS message CLASS fields - the DNS protocol defines multiple classes (IN for Internet, CH for CHAOS, HS for HESIOD) and meta-classes (ANY, NONE) used in queries; named's code paths for recursion, dynamic updates (RFC 2136), NOTIFY (RFC 1996), and record-type processing fail to properly validate when these non-IN or meta-class messages reach assertion-protected logic, resulting in process termination. The CPE cpe:2.3:a:isc:bind_9:*:*:*:*:*:*:*:* covers the entire BIND 9 product line, including the Subscription Edition (S1) branches used by ISC support customers.

Know when Bind 9 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (isc) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (isc).

CVSS VectorVendor: isc

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet (IN) - for example, CHAOS or HESIOD, or DNS messages that specify meta-classes (ANY or NONE) in the question section. Specially crafted requests reaching the affected code paths - recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data - can cause assertion failures in named. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Executive ViewAI

Why It Matters

ISC BIND 9 resolver software contains a remote denial-of-service vulnerability affecting versions 9.11.0 through 9.21.21 that allows unauthenticated attackers to crash DNS infrastructure. Any organization running vulnerable BIND versions faces DNS service disruption risk, which cascades to application availability and user access across all Internet-facing services.

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Social Media
3
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Bind 9

View all
CVE-2026-1519 HIGH POC
7.5 Mar 25

BIND resolver servers performing DNSSEC validation can be forced into excessive CPU consumption when encountering a mali
CVE-2026-3104 HIGH POC
7.5 Mar 25

Memory exhaustion in BIND 9 resolver allows unauthenticated remote attackers to cause denial of service by querying spec
CVE-2026-3593 CRITICAL
9.8 May 20

Memory corruption in ISC BIND 9's DNS-over-HTTPS (DoH) implementation lets remote attackers trigger a use-after-free (CW
CVE-2026-13321 HIGH
8.6 Jul 22

DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling

CVE-2026-94300 HIGH
8.1 Oct 21

Memory corruption in ISC BIND 9's GSS-TSIG handling allows an on-path attacker who captures a previously signed UDP mess
CVE-2026-11622 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 lets a remote unauthenticated attacker exhaust resolver memory by flooding a DNSSEC-vali
CVE-2026-13204 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an attacker crash a validating resolver via a maliciously crafted DNSSEC pro
CVE-2026-11605 HIGH
7.5 Jul 22

Denial of service in ISC BIND 9 resolvers (9.20.0-9.20.24, 9.21.0-9.21.23, and 9.20.9-S1-9.20.24-S1) lets remote unauthe
CVE-2026-11721 HIGH
7.5 Jul 22

Cache poisoning in ISC BIND 9 recursive resolvers allows an attacker who controls an authoritative zone to inject forged
CVE-2026-11331 HIGH
7.5 Jul 22

RPZ policy bypass and remote denial-of-service in ISC BIND 9 resolvers lets unauthenticated attackers defeat Response Po
CVE-2026-12617 HIGH
7.5 Jul 22

Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing an
CVE-2026-80274 HIGH
7.5 Sep 16

Denial of service in ISC BIND 9 recursive resolvers affects versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.2

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed

References

Advisories & patches
PATCH https://downloads.isc.org/isc/bind9/9.18.49 PATCH https://downloads.isc.org/isc/bind9/9.20.23 PATCH https://downloads.isc.org/isc/bind9/9.21.22 ADVISORY https://access.redhat.com/errata/RHSA-2026:20334 ADVISORY https://kb.isc.org/docs/cve-2026-5946 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5946 ADVISORY https://ubuntu.com/security/notices/USN-8293-1 ADVISORY https://vuldb.com/vuln/364881 REF https://access.redhat.com/errata/RHSA-2026:23360 REF https://access.redhat.com/errata/RHSA-2026:24338 REF https://access.redhat.com/errata/RHSA-2026:24339 REF https://access.redhat.com/errata/RHSA-2026:24367 REF https://access.redhat.com/errata/RHSA-2026:24368 REF https://access.redhat.com/errata/RHSA-2026:55441 REF https://access.redhat.com/errata/RHSA-2026:57189 REF https://access.redhat.com/errata/RHSA-2026:60383 REF https://access.redhat.com/errata/RHSA-2026:62549 REF https://access.redhat.com/errata/RHSA-2026:65851 REF https://access.redhat.com/security/cve/CVE-2026-5946 REF https://bugzilla.redhat.com/show_bug.cgi?id=2479771 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5946.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy