CVE-2026-5947 — Race Condition in ISC Bind

Vendor	Product	Version range	Fixed in
isc	bind	—	—
isc	bind	>= 9.20.0 < 9.20.23	9.20.23
isc	bind	>= 9.21.0 < 9.21.22	9.21.22
isc	bind_9	9.20.0 – 9.20.22	—
isc	bind_9	9.20.9-S1 – 9.20.22-S1	—
isc	bind_9	9.21.0 – 9.21.21	—
isc	dhcp	—	—
ubuntu	bind9	—	—

Ubuntu

Bind vulnerabilities

vendor_ubuntu·2026-05-21·CVSS 7.5

CVE-2026-5950 [HIGH] Bind vulnerabilities Title: Bind vulnerabilities Summary: Several security issues were fixed in Bind. Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. (CVE-2026-3039) Shuhan Zhang discovered that Bind incorrectly handled self-pointed glue records. A remote attacker could possibly use this issue to use Bind in denial of service amplification attacks against other systems. (CVE-2026-3592) Naresh Kandula Parmar discovered that Bind incorrectly handled memory in the DNS-over-HTTPS implementation. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service, or execute arbitrary code. This issue only affe

Red Hat

bind: SIG(0) validation during query flood may lead to undefined behavior

vendor_redhat·2026-05-21·CVSS 5.9

CVE-2026-5947 [MEDIUM] CWE-367 bind: SIG(0) validation during query flood may lead to undefined behavior bind: SIG(0) validation during query flood may lead to undefined behavior A flaw was found in BIND. A remote attacker could exploit a race condition during SIG(0) signature validation of an incoming DNS message. If the "recursive-clients" limit is reached and the message is discarded, a use-after-free vulnerability may occur. This could lead to undefined behavior and potentially result in a denial of service. Statement: Important: A race condition in BIND's SIG(0) validation process can lead to undefined behavior and a denial of service when the server is under a query flood and processing signed DNS messages. This flaw could disrupt critical DNS resolution services in Red Hat environments. Mitigation: Mitigation for this issue is either not available or the currently available options

GHSA

GHSA-6mm6-m775-chpm: Undefined behavior may result due to a race condition leading to a use-after-free violation

ghsa_unreviewed·2026-05-20

CVE-2026-5947 [HIGH] CWE-362 GHSA-6mm6-m775-chpm: Undefined behavior may result due to a race condition leading to a use-after-free violation Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

VulDB

ISC BIND up to 9.21.21 DNS Message race condition (Nessus ID 315662)

vuldb·2026-05-20·CVSS 7.5

CVE-2026-5947 [HIGH] ISC BIND up to 9.21.21 DNS Message race condition (Nessus ID 315662) A vulnerability was found in ISC BIND up to 9.18.48/9.18.49-S0/9.20.22/9.20.22-S1/9.21.21. It has been rated as problematic. Impacted is an unknown function of the component DNS Message Handler. Performing a manipulation results in race condition. This vulnerability is known as CVE-2026-5947. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

CVE-2026-5947: Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it…

Affected

CVSS provenance