CVE-2026-5947: SIG(0) validation during query flood may lead to undefined behavior
Last updated 22 May 2026
Other sources
SIG(0) validation during query flood may lead to undefined behavior
— Microsoft
Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/bind9to a version that resolves this vulnerability.Fixed in 1:9.16.50-1~deb11u2Fixed in 1:9.16.50-1~deb11u5Fixed in 1:9.18.47-1~deb12u1Fixed in 1:9.18.49-1~deb12u1Fixed in 1:9.20.23-1~deb13u1Fixed in 1:9.20.23-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.21.22 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.20.23-S1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5947?
CVE-2026-5947 has a severity rating that indicates significant risk due to potential undefined behavior from a use-after-free violation.
How do I fix CVE-2026-5947?
To fix CVE-2026-5947, update ISC BIND 9 to version 9.20.23 or later, or 9.21.22 or later.
What kind of vulnerability is CVE-2026-5947?
CVE-2026-5947 is a race condition vulnerability that can lead to undefined behavior during SIG(0) validation.
Which versions of ISC BIND 9 are affected by CVE-2026-5947?
ISC BIND 9 versions from 9.20.0 to 9.20.22, 9.21.0 to 9.21.21, and 9.20.9-S1 to 9.20.22-S1 are affected by CVE-2026-5947.
What impact does CVE-2026-5947 have on system security?
CVE-2026-5947 may allow attackers to exploit the race condition leading to potential system crashes or unauthorized access.