CVE-2026-5946 is an important denial of service vulnerability in the named daemon of ISC BIND 9. It arises from improper input validation (CWE-20, CWE-1287) when processing DNS messages that use classes other than Internet (IN), such as CHAOS or HESIOD, or meta-classes like ANY or NONE. These specially crafted DNS messages targeting recursion, dynamic updates, zone notifications, or IN-specific record processing in non-IN data can trigger assertion failures causing the named daemon to crash. The vulnerability affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and their S1 variants. Red Hat has issued security advisories and released patches for affected products including Red Hat Enterprise Linux 10. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and high availability impact. No known active exploits have been reported. Mitigations other than patching are limited or do not meet vendor criteria.

Successful exploitation causes assertion failures in the named daemon, resulting in application-level denial of service and DNS service unavailability. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction. This can disrupt DNS resolution services relying on the affected BIND 9 versions.

A patch is available and has been released by ISC and vendors such as Red Hat. Users should apply the official security updates to affected BIND 9 versions as soon as possible. Vendor advisories indicate that no effective mitigations other than patching currently meet criteria for ease of use and applicability. Red Hat customers should follow the update instructions in their advisories. Monitoring for unusual DNS message classes and restricting access to DNS services may reduce exposure but are not formal mitigations.