ISC BIND 9 CVE-2026-5950

The primary fix is to upgrade BIND 9 to a patched release issued by ISC. Patched versions are available for all affected branches: 9.18.49 at https://downloads.isc.org/isc/bind9/9.18.49, 9.20.23 at https://downloads.isc.org/isc/bind9/9.20.23, and 9.21.22 at https://downloads.isc.org/isc/bind9/9.21.22. Subscription Edition users should obtain the corresponding S1 patch builds through ISC's subscription channel. If immediate patching is operationally infeasible, reduce attack surface by tightening recursive resolver access: configure allow-recursion and allow-query-cache ACLs in named.conf to restrict query acceptance to known trusted client IP ranges, preventing untrusted network actors from reaching the vulnerable state machine path - note this will break resolution for any legitimate clients outside the ACL scope. Additionally, configuring DNS rate limiting via the rate-limit clause in named.conf can reduce the volume of concurrent exploit attempts, though it may also affect throughput for legitimate high-volume query sources. These are compensating controls only; they do not fix the underlying loop condition. The ISC advisory at https://kb.isc.org/docs/cve-2026-5950 should be consulted for any additional mitigations or configuration guidance.