Vulnerability · Published May 20, 2026 · Assigned by isc

CVE-2026-5947SIG(0) validation during query flood may lead to undefined behavior

High 7.5

In plain English

A high-severity race condition in BIND 9 from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.4%top 27.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	bind	9.18.49-r0	ALPINE-CVE-2026-5947
Alpine:v3.21	bind	9.18.49-r0	ALPINE-CVE-2026-5947
Alpine:v3.22	bind	9.20.23-r0	ALPINE-CVE-2026-5947
Alpine:v3.23	bind	9.20.23-r0	ALPINE-CVE-2026-5947
Alpine:v3.24	bind	9.20.23-r0	ALPINE-CVE-2026-5947
Debian:13	bind9	1:9.20.23-1~deb13u1	DEBIAN-CVE-2026-5947
Debian:14	bind9	1:9.20.23-1	DEBIAN-CVE-2026-5947
Ubuntu:25.10	bind9	1:9.20.11-1ubuntu2.4	UBUNTU-CVE-2026-5947
Ubuntu:26.04:LTS	bind9	1:9.20.18-1ubuntu2.1	UBUNTU-CVE-2026-5947

Affected products (as reported)

Vendor	Product	Versions
ISC	BIND 9	9.20.0 – through 9.20.229.21.0 – through 9.21.219.20.9-S1 – through 9.20.22-S1

Weakness: CWE-362, CWE-416, CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-5947 vendor-advisory
https://downloads.isc.org/isc/bind9/9.20.23 patch
https://downloads.isc.org/isc/bind9/9.21.22 patch
https://access.redhat.com/security/cve/CVE-2026-5947 vdb-entry, x_refsource_REDHAT
RHBZ#2479772 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5947.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:7412 vendor-advisory, x_refsource_REDHAT