CVE-2026-5947 SIG(0) validation during query flood may lead to undefined behavior
A race condition in BIND's SIG(0) validation during query floods can cause a use-after-free, potentially leading to crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5947?
CVE-2026-5947 is a high-severity use after free vulnerability in Isc Bind, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.
Which versions are affected by CVE-2026-5947?
It affects 1 product.
Products include Isc Bind.
How do I fix CVE-2026-5947?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-5947 being exploited?
There is no known exploitation of CVE-2026-5947 in the wild and no public exploit code.
Other vulnerabilities in Isc Bind
Sources
Also known as ALPINE-CVE-2026-5947, AZL-87099, BELL-CVE-2026-5947, DEBIAN-CVE-2026-5947, ECHO-e0dd-6c9a-2e1c, GHSA-6mm6-m775-chpm and 2 more.