Every CVESearch/Get API key

CVE-2026-5950

Unbounded resend loop in BIND 9 resolver

5.3 MediumPublic exploitFix available

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.66%Up 0.6 points since May 21, 2026
90%50%10%1%

What each source reports

CVE List Score used5.3

Unbounded resend loop in BIND 9 resolver

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
CVE-2026-5950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-606
Updated
2026-11-02
EUVDEUVD-2026-311095.3

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
EUVD-2026-31109
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-2pjm-rchf-gxmp5.3

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad...

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
GHSA-2pjm-rchf-gxmp
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-606
Updated
2026-11-02
NVD5.3

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
CVE-2026-5950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-606
Updated
2026-11-02
OSVALPINE-CVE-2026-59505.3

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
ALPINE-CVE-2026-5950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBELL-CVE-2026-59505.3
Record
BELL-CVE-2026-5950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 15 moreShow less
OSV5.3

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
CVE-2026-5950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2026-59505.3

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
DEBIAN-CVE-2026-5950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:203347.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:20334
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:972425.3

Moderate: bind security, bug fix, and enhancement update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

  • bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)

  • bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)

Bug Fix(es) and Enhancement(s):

  • [BUG] Bind DNS forwarder when configured to allow stale answers fails to provide resonse of 3 layer CNAME when TTL abruptly changes to 0 [rhel-10] (JIRA:Rocky Linux-142289)

  • [rhel-10] Bind 9.18.33 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-144421)

  • bind: New root trust anchor key for DNSSEC [rhel-10.3] (JIRA:Rocky Linux-255748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Record
RLSA-2026:97242
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-13
OSVRLSA-2026:975855.3

Moderate: bind9.18 security, bug fix, and enhancement update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

  • bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)

  • bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)

Bug Fix(es) and Enhancement(s):

  • Bind 9.18.29 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-144422)

  • [BUG] Bind DNS forwarder when configured to allow stale answers fails to provide resonse of 3 layer CNAME when TTL abruptly changes to 0 (JIRA:Rocky Linux-86172)

  • bind9.18: New root trust anchor key for DNSSEC [rhel-9.9] (JIRA:Rocky Linux-255678)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Record
RLSA-2026:97585
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-13
OSVRLSA-2026:975865.3

Moderate: bind security, bug fix, and enhancement update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

  • bind: Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)

  • bind: Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)

Bug Fix(es) and Enhancement(s):

  • Bind 9.16.23 DNSSEC Key Rollover with KASP Causes ZSK Key To Be Removed Prematurely (JIRA:Rocky Linux-12487)

  • nslookup does not return and hang at epoll_wait() on some special occasions. (JIRA:Rocky Linux-29712)

  • Update to latest minor version 9.16.50 [rhel-9.9] (JIRA:Rocky Linux-6454)

  • pkcs11-tools test failing on engine (JIRA:Rocky Linux-213788)

  • dig on s390x does not return output when fails (JIRA:Rocky Linux-212648)

  • bind: New root trust anchor key for DNSSEC [rhel-9.9] (JIRA:Rocky Linux-255745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Record
RLSA-2026:97586
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-13
OSVUBUNTU-CVE-2026-59505.3

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
UBUNTU-CVE-2026-5950
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-87102No score

CVE-2026-5950 affecting package bind for versions less than 9.20.23-1

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Record
AZL-87102
Updated
2026-11-02
OSVCLSA-2026-1780406442No score

bind: Fix of 2 CVEs

  • CVE-2026-5950: fix unbounded resend loop in resolver bad-server handling
  • CVE-2026-3592: limit addresses returned per ADB find and dedup resolver SLIST to mitigate resource-exhaustion amplification
Record
CLSA-2026-1780406442
Updated
2026-11-02
OSVMGASA-2026-0163No score

Updated bind packages fix security vulnerabilities

Updated bind package fixes security vulnerabilities:

  • BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
  • Amplification vulnerabilities via self-pointed glue records (CVE-2026-3592)
  • Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (CVE-2026-3593)
  • Invalid handling of CLASS != IN (CVE-2026-5946)
  • SIG(0) validation during query flood may lead to undefined behavior (CVE-2026-5947) *Unbounded resend loop in BIND 9 resolver (CVE-2026-5950)
Record
MGASA-2026-0163
Updated
2026-11-02
OSVopenSUSE-SU-2026:10874-1No score

bind-9.20.23-1.1 on GA media

These are all security issues fixed in the bind-9.20.23-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10874-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21123-1No score

Security update for bind

This update for bind fixes the following issues

Upgrade to release 9.20.23:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Record
openSUSE-SU-2026:21123-1
Updated
2026-11-02
OSVSUSE-SU-2026:22198-1No score

Security update for bind

This update for bind fixes the following issues

Upgrade to release 9.20.23:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
Record
SUSE-SU-2026:22198-1
Updated
2026-11-02
OSVSUSE-SU-2026:2673-1No score

Security update for bind

This update for bind fixes the following issues:

Security issues:

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior (bsc#1265595).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).

Non security issue:

  • bind test failed with version 9.20.21 (bsc#1263494).
  • Upgrade to release 9.20.23
Record
SUSE-SU-2026:2673-1
Updated
2026-11-02
OSVSUSE-SU-2026:2676-1No score

Security update for bind

This update for bind fixes the following issues

  • CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (bsc#1265591).
  • CVE-2026-3592: Amplification vulnerabilities via self-pointed glue records (bsc#1265592).
  • CVE-2026-5946: Invalid handling of CLASS != IN (bsc#1265594).
  • CVE-2026-5950: Unbounded resend loop in BIND 9 resolver (bsc#1265596).
  • CVE-2026-3593: Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (bsc#1265593).

Changes for bind:

  • Update to release 9.18.49
Record
SUSE-SU-2026:2676-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bind
Alpine:v3.20
9.18.36 up to 9.18.49-r0
9.18.49-r0
bind
Alpine:v3.21
9.18.36 up to 9.18.49-r0
9.18.49-r0
bind
Alpine:v3.22
9.18.36 up to 9.20.23-r0
9.20.23-r0
bind
Alpine:v3.23
9.18.36 up to 9.20.23-r0
9.20.23-r0
bind
Alpine:v3.24
9.18.36 up to 9.20.23-r0
9.20.23-r0
bind
Azure Linux:3
before 9.20.23-1
9.20.23-1
bind
Alpaquita:23
9.18.11-r0 up to 9.18.49-r0
9.18.49-r0
bind
Alpaquita:25
9.20.9-r0 up to 9.20.23-r0
9.20.23-r0
bind
Alpaquita:stream
9.18.16-r0 up to 9.20.23-r0
9.20.23-r0
bind
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
Show 78 moreShow less
Affected packages
PackageAffectedFixed
bind-chroot
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-dnssec-doc
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-dnssec-utils
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-doc
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-license
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind-utils
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
python3-bind
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 32:9.16.23-11.el9_2.2.tuxcare.els12
32:9.16.23-11.el9_2.2.tuxcare.els12
bind9
Debian:12
before 1:9.18.49-1~deb12u2, plus listed versions
1:9.18.12-11:9.18.13-11:9.18.16-11:9.18.16-1~deb12u11:9.18.16-1~deb12u1~bpo11+1
Show 11 moreShow less
1:9.18.19-1~deb12u11:9.18.19-1~deb12u1~bpo11+11:9.18.24-11:9.18.24-1~bpo11+11:9.18.28-1~deb12u11:9.18.28-1~deb12u21:9.18.33-1~deb12u21:9.18.41-1~deb12u11:9.18.44-1~deb12u11:9.18.47-1~deb12u11:9.18.49-1~deb12u1
1:9.18.49-1~deb12u2
bind9
Debian:13
before 1:9.20.23-1~deb13u1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 12 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-1~deb13u1~bpo12+1
1:9.20.23-1~deb13u1
bind9
Debian:14
before 1:9.20.23-1, plus listed versions
1:9.20.11-41:9.20.15-11:9.20.15-1~deb13u11:9.20.15-1~deb13u1~bpo12+11:9.20.15-2
Show 13 moreShow less
1:9.20.18-11:9.20.18-1~deb13u11:9.20.18-1~deb13u1~bpo12+11:9.20.19-11:9.20.19-1~bpo12+11:9.20.20-11:9.20.20-1~bpo12+11:9.20.21-11:9.20.21-1~deb13u11:9.20.21-1~deb13u1~bpo12+11:9.20.22-11:9.20.23-1~deb13u11:9.20.23-1~deb13u1~bpo12+1
1:9.20.23-1
bind
Mageia:9
From an advisory covering 6 CVEs
before 9.18.49-1.mga9
9.18.49-1.mga9
bind
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-chroot
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-dnssec-utils
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-doc
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-libs
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-utils
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
before 0:9.18.49-1.hum1
0:9.18.49-1.hum1
bind-devel
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-dnssec-utils-debuginfo
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-libs-debuginfo
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-chroot
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-debugsource
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-debuginfo
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-dnssec-utils
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-utils-debuginfo
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-utils
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-libs
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-doc
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind-license
Rocky Linux:10
From an advisory covering 2 CVEs
before 2:9.18.33-29.el10_3
2:9.18.33-29.el10_3
bind9.18
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-chroot
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-debugsource
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-devel
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-dnssec-utils
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-dnssec-utils-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-libs
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-libs-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-utils
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-utils-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind9.18-doc
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.18.29-28.el9_9
2:9.18.29-28.el9_9
bind
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-chroot
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-debugsource
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-devel
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-dnssec-utils
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-dnssec-utils-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-libs
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-libs-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-utils
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-utils-debuginfo
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-dnssec-doc
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-doc
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind-license
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
python3-bind
Rocky Linux:9
From an advisory covering 2 CVEs
before 2:9.16.50-11.el9_9
2:9.16.50-11.el9_9
bind
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
before 9.20.23-160000.1.1
9.20.23-160000.1.1
bind
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
before 9.20.23-160000.1.1
9.20.23-160000.1.1
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
before 9.20.23-150700.3.25.1
9.20.23-150700.3.25.1
bind
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 6 CVEs
before 9.20.23-150700.3.25.1
9.20.23-150700.3.25.1
bind
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 5 CVEs
before 9.18.49-150600.3.26.1
9.18.49-150600.3.26.1
bind
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 5 CVEs
before 9.18.49-150600.3.26.1
9.18.49-150600.3.26.1
isc-dhcp
Ubuntu:18.04:LTS
All versions, plus listed versions
4.3.5-3ubuntu24.3.5-3ubuntu34.3.5-3ubuntu44.3.5-3ubuntu54.3.5-3ubuntu6
Show 5 moreShow less
4.3.5-3ubuntu74.3.5-3ubuntu7.14.3.5-3ubuntu7.24.3.5-3ubuntu7.34.3.5-3ubuntu7.4
None known
bind9-libs
Ubuntu:20.04:LTS
All versions, plus listed versions
1:9.11.16+dfsg-3~build11:9.11.16+dfsg-3~ubuntu1
None known
bind9
Ubuntu:22.04:LTS
before 1:9.18.39-0ubuntu0.22.04.4, plus listed versions
1:9.16.15-1ubuntu11:9.16.15-1ubuntu21:9.16.15-1ubuntu31:9.18.0-2ubuntu11:9.18.0-2ubuntu2
Show 17 moreShow less
1:9.18.0-2ubuntu31:9.18.1-1ubuntu11:9.18.1-1ubuntu1.11:9.18.1-1ubuntu1.21:9.18.1-1ubuntu1.31:9.18.12-0ubuntu0.22.04.11:9.18.12-0ubuntu0.22.04.21:9.18.12-0ubuntu0.22.04.31:9.18.18-0ubuntu0.22.04.11:9.18.18-0ubuntu0.22.04.21:9.18.24-0ubuntu0.22.04.11:9.18.28-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.11:9.18.30-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.11:9.18.39-0ubuntu0.22.04.21:9.18.39-0ubuntu0.22.04.3
1:9.18.39-0ubuntu0.22.04.4
bind9-libs
Ubuntu:22.04:LTS
All versions, plus listed versions
1:9.11.19+dfsg-2.1ubuntu11:9.11.19+dfsg-2.1ubuntu21:9.11.19+dfsg-2.1ubuntu3
None known
bind9
Ubuntu:24.04:LTS
before 1:9.18.39-0ubuntu0.24.04.5, plus listed versions
1:9.18.18-0ubuntu21:9.18.21-0ubuntu11:9.18.24-0ubuntu31:9.18.24-0ubuntu41:9.18.24-0ubuntu5
Show 6 moreShow less
1:9.18.28-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.11:9.18.30-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.11:9.18.39-0ubuntu0.24.04.21:9.18.39-0ubuntu0.24.04.3
1:9.18.39-0ubuntu0.24.04.5
isc-dhcp
Ubuntu:24.04:LTS
All versions, plus listed versions
4.4.3-P1-2ubuntu54.4.3-P1-4ubuntu14.4.3-P1-4ubuntu2
None known
bind9
Ubuntu:25.10
before 1:9.20.11-1ubuntu2.4, plus listed versions
1:9.20.4-3ubuntu11:9.20.4-3ubuntu21:9.20.4-3ubuntu31:9.20.9-2ubuntu11:9.20.10-1ubuntu1
Show 4 moreShow less
1:9.20.11-1ubuntu11:9.20.11-1ubuntu21:9.20.11-1ubuntu2.11:9.20.11-1ubuntu2.2
1:9.20.11-1ubuntu2.4
isc-dhcp
Ubuntu:25.10
All versions, plus listed versions
4.4.3-P1-4ubuntu2
None known
bind9
Ubuntu:26.04:LTS
before 1:9.20.18-1ubuntu2.1, plus listed versions
1:9.20.11-1ubuntu21:9.20.11-1ubuntu31:9.20.18-1ubuntu11:9.20.18-1ubuntu2
1:9.20.18-1ubuntu2.1
isc-dhcp
Ubuntu:26.04:LTS
All versions, plus listed versions
4.4.3-P1-4ubuntu2
None known
bind
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
before 9.20.23-1.1
9.20.23-1.1
bind
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
before 9.20.23-160000.1.1
9.20.23-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubbillybaraja/cve-2026-5950-bind9-resolver-dos2026-06-14

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5950 is a medium vulnerability (CVSS 5.3) in Isc Bind, published May 20, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in bind 9.18.49-r0.

References

Show 50 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open