Every CVE Search/ Get API key

CVE-2026-5947

SIG(0) validation during query flood may lead to undefined behavior

7.5 HighFix available

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.39%Up 1.4 points since May 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

SIG(0) validation during query flood may lead to undefined behavior

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
CVE-2026-5947
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362, CWE-416, CWE-367
Updated
2026-11-02
EUVDEUVD-2026-31110 7.5

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
EUVD-2026-31110
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6mm6-m775-chpm 7.5

Undefined behavior may result due to a race condition leading to a use-after-free violation. If...

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
GHSA-6mm6-m775-chpm
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362, CWE-367
Updated
2026-11-02
NVD 7.5

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
CVE-2026-5947
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-362, CWE-416, CWE-367
Updated
2026-11-02
OSVALPINE-CVE-2026-5947 5.9

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
ALPINE-CVE-2026-5947
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-5947 5.9
Record
BELL-CVE-2026-5947
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSV 5.9

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
CVE-2026-5947
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-5947 5.9

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
DEBIAN-CVE-2026-5947
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:7412 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7412
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-5947 7.5

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
UBUNTU-CVE-2026-5947
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-87099 No score

CVE-2026-5947 affecting package bind for versions less than 9.20.23-1

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Record
AZL-87099
Updated
2026-11-02
OSVMGASA-2026-0163 No score

Updated bind packages fix security vulnerabilities

Updated bind package fixes security vulnerabilities:

  • BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
  • Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)
  • Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (CVE-2026-3593)
  • Invalid handling of CLASS != IN (CVE-2026-5946)
  • SIG(0) validation during query flood may lead to undefined behavior (CVE-2026-5947) *Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)
Record
MGASA-2026-0163
Updated
2026-11-02
OSVopenSUSE-SU-2026:10874-1 No score

bind-9.20.23-1.1 on GA media

These are all security issues fixed in the bind-9.20.23-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10874-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21123-1 No score

Security update for bind

This update for bind fixes the following issues

Upgrade to release 9.20.23:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Record
openSUSE-SU-2026:21123-1
Updated
2026-11-02
OSVSUSE-SU-2026:22198-1 No score

Security update for bind

This update for bind fixes the following issues

Upgrade to release 9.20.23:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Record
SUSE-SU-2026:22198-1
Updated
2026-11-02
OSVSUSE-SU-2026:2673-1 No score

Security update for bind

This update for bind fixes the following issues:

Security issues:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).

Non security issue:

  • bind test failed with version 9.20.21 (bsc#1263494).
  • Upgrade to release 9.20.23
Record
SUSE-SU-2026:2673-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bind
Alpine:v3.20
 9.20.0 up to 9.18.49-r0
9.18.49-r0
bind
Alpine:v3.21
 9.20.0 up to 9.18.49-r0
9.18.49-r0
bind
Alpine:v3.22
 9.20.0 up to 9.20.23-r0
9.20.23-r0
bind
Alpine:v3.23
 9.20.0 up to 9.20.23-r0
9.20.23-r0
bind
Alpine:v3.24
 9.20.0 up to 9.20.23-r0
9.20.23-r0
bind
Azure Linux:3
 before 9.20.23-1
9.20.23-1
bind
Alpaquita:23
 9.18.11-r0 up to 9.18.49-r0
9.18.49-r0
bind
Alpaquita:25
 9.20.9-r0 up to 9.20.23-r0
9.20.23-r0
bind
Alpaquita:stream
 9.18.16-r0 up to 9.20.23-r0
9.20.23-r0
bind9
Debian:13
 before 1:9.20.23-1~deb13u1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 12 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-1~deb13u1~bpo12+1
1:9.20.23-1~deb13u1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
bind9
Debian:14
 before 1:9.20.23-1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 13 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-1~deb13u11:9.20.23-1~deb13u1~bpo12+1
1:9.20.23-1
bind
Mageia:9
From an advisory covering 6 CVEs
 before 9.18.49-1.mga9
9.18.49-1.mga9
bind
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.18.48-1.1.hum1
0:9.18.48-1.1.hum1
bind-chroot
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.18.48-1.1.hum1
0:9.18.48-1.1.hum1
bind-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.18.48-1.1.hum1
0:9.18.48-1.1.hum1
bind-dnssec-utils
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.18.48-1.1.hum1
0:9.18.48-1.1.hum1
bind-doc
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.18.48-1.1.hum1
0:9.18.48-1.1.hum1
bind-libs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.18.48-1.1.hum1
0:9.18.48-1.1.hum1
bind-utils
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:9.18.48-1.1.hum1
0:9.18.48-1.1.hum1
bind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 9.20.23-160000.1.1
9.20.23-160000.1.1
bind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 9.20.23-160000.1.1
9.20.23-160000.1.1
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 9.20.23-150700.3.25.1
9.20.23-150700.3.25.1
bind
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 6 CVEs
 before 9.20.23-150700.3.25.1
9.20.23-150700.3.25.1
bind9
Ubuntu:25.10
 before 1:9.20.11-1ubuntu2.4, plus listed versions
1:9.20.4-3ubuntu11:9.20.4-3ubuntu21:9.20.4-3ubuntu31:9.20.9-2ubuntu11:9.20.10-1ubuntu1
Show 4 moreShow less
1:9.20.11-1ubuntu11:9.20.11-1ubuntu21:9.20.11-1ubuntu2.11:9.20.11-1ubuntu2.2
1:9.20.11-1ubuntu2.4
bind9
Ubuntu:26.04:LTS
 before 1:9.20.18-1ubuntu2.1, plus listed versions
1:9.20.11-1ubuntu21:9.20.11-1ubuntu31:9.20.18-1ubuntu11:9.20.18-1ubuntu2
1:9.20.18-1ubuntu2.1
bind
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 9.20.23-1.1
9.20.23-1.1
bind
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 9.20.23-160000.1.1
9.20.23-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5947 is a high vulnerability (CVSS 7.5) in Isc Bind, published May 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in bind 9.18.49-r0.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open