The vulnerability CVE-2026-5950 in ISC BIND 9 arises from improper validation of input controlling a loop condition in the resolver's state machine during handling of bad servers. Specifically, certain crafted DNS queries can trigger a resend loop that is unbounded, leading to resource exhaustion on the affected system. This affects multiple versions of BIND 9, including 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, and 9.21.7 through 9.21.21, including some S1 variants. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, no privileges or user interaction required, and impact limited to availability (resource exhaustion). The vendor has published the vulnerability but has not yet provided an official fix or remediation level. The vulnerability is categorized under CWE-606 (Unchecked Input for Loop Condition).

An unauthenticated remote attacker can exploit this vulnerability to cause severe resource exhaustion on the affected BIND 9 resolver by triggering an unbounded resend loop. This impacts the availability of the DNS resolver service but does not affect confidentiality or integrity. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the ISC vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections such as rate limiting DNS queries or filtering suspicious traffic patterns that may trigger retry conditions. Monitor ISC advisories closely for updates.