CVE-2026-5946

HighCVSS 7.5/10Last modified Sep 17, 2026

Description

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20CWE-125CWE-617CWE-754CWE-843CWE-1287

Affected software

VendorProductVersions
ISCBIND 9>= 9.11.0, <= 9.16.50; >= 9.18.0, <= 9.18.48; >= 9.20.0, <= 9.20.22; >= 9.21.0, <= 9.21.21; >= 9.11.3-S1, <= 9.16.50-S1; >= 9.18.11-S1, <= 9.18.48-S1; >= 9.20.9-S1, <= 9.20.22-S1
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat Hardened Images—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat OpenShift Container Platform 4—

References

Timeline

Published
May 20, 2026
Last modified
Sep 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-59475.9Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signeCVE-2026-594998.6: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by CVE-2026-59505.3An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticCVE-2026-5950010.0: Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affectCVE-2026-595018.2: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affectCVE-2026-595025.3: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affectsCVE-2026-595039.1: Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerabiliCVE-2026-595049.1: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft SolutiCVE-2026-595058.6: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affectCVE-2026-595069.3: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft SolutionsCVE-2026-595079.3: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in PrioCVE-2026-595085.9Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos. This issue affects i-
CVE-2026-5946: High severity, CVSS 7.5 | Vulnix