CVE-2026-5946: CWE-20 Improper Input Validation in ISC BIND 9
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
AI Analysis
Technical Summary
CVE-2026-5946 describes multiple improper input validation vulnerabilities (CWE-20) in ISC BIND 9's named DNS server related to the handling of DNS messages whose CLASS field is not Internet (IN), such as CHAOS or HESIOD, or that specify meta-classes like ANY or NONE in the question section. These flaws can trigger assertion failures during processing of recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or when handling IN-specific record types in non-IN data. The affected versions include BIND 9 releases from 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and their S1 variants. The issue results in denial of service by causing the named server to crash or become unresponsive. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. Vendor advisories from Red Hat confirm the issue and provide patches for affected products. The vulnerability is present in on-premises and cloud-hosted deployments, but for cloud services the vendor manages remediation.
Potential Impact
The vulnerability causes denial of service (availability impact) in the BIND 9 named DNS server by triggering assertion failures when processing specially crafted DNS messages with non-IN classes or meta-classes. There is no impact on confidentiality or integrity. Exploitation requires sending crafted DNS requests over the network and does not require privileges or user interaction. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A patch is available for this vulnerability and should be applied promptly. Red Hat has released security updates for affected BIND 9 versions in Red Hat Enterprise Linux 10 and related products. For cloud-hosted BIND 9 services, the vendor manages remediation server-side. Administrators should consult the vendor advisories and apply the official fixes as instructed. No additional mitigations are specified or required beyond applying the vendor-provided patches.
CVE-2026-5946: CWE-20 Improper Input Validation in ISC BIND 9
Description
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/isc/bind9Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-5946 describes multiple improper input validation vulnerabilities (CWE-20) in ISC BIND 9's named DNS server related to the handling of DNS messages whose CLASS field is not Internet (IN), such as CHAOS or HESIOD, or that specify meta-classes like ANY or NONE in the question section. These flaws can trigger assertion failures during processing of recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or when handling IN-specific record types in non-IN data. The affected versions include BIND 9 releases from 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and their S1 variants. The issue results in denial of service by causing the named server to crash or become unresponsive. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. Vendor advisories from Red Hat confirm the issue and provide patches for affected products. The vulnerability is present in on-premises and cloud-hosted deployments, but for cloud services the vendor manages remediation.
Potential Impact
The vulnerability causes denial of service (availability impact) in the BIND 9 named DNS server by triggering assertion failures when processing specially crafted DNS messages with non-IN classes or meta-classes. There is no impact on confidentiality or integrity. Exploitation requires sending crafted DNS requests over the network and does not require privileges or user interaction. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A patch is available for this vulnerability and should be applied promptly. Red Hat has released security updates for affected BIND 9 versions in Red Hat Enterprise Linux 10 and related products. For cloud-hosted BIND 9 services, the vendor manages remediation server-side. Administrators should consult the vendor advisories and apply the official fixes as instructed. No additional mitigations are specified or required beyond applying the vendor-provided patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- isc
- Date Reserved
- 2026-04-09T06:40:07.319Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-5946","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24338","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24339","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:23360","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24367","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24368","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:20334","vendor":"Red Hat"}]
Threat ID: 6a0db4dcba1db473627ecd84
Added to database: 05/20/2026, 13:19:24 UTC
Last enriched: 07/15/2026, 09:35:16 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.