HIGHVulnerability
CVE-2026-5947
Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.
Properties
- severity
- HIGH
- score
- 7.5
- cve_id
- CVE-2026-5947
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- published_at
- 2026-05-20T13:16:40.303
- last_modified
- 2026-08-24T13:19:13.360
Related Entities (5)
HAS_WEAKNESS (3)
→[Weakness]Use After Free
→[Weakness]Time-of-check Time-of-use (TOCTOU) Race Condition
→[Weakness]Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
DESCRIBED_BY (1)
→[Source]NVD
AFFECTS_PRODUCT (1)
→[Product]
Explore deeper with Ninja Signal's threat intelligence graph