CVE-2026-5950 Unbounded resend loop in BIND 9 resolver
Remote attackers can cause severe resource exhaustion in BIND 9 resolver via unbounded resend loops, requiring patches to prevent service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5950?
CVE-2026-5950 is a medium-severity denial of service vulnerability in Isc Bind, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Weakness: CWE-606
Which versions are affected by CVE-2026-5950?
It affects 1 product.
Products include Isc Bind.
How do I fix CVE-2026-5950?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-5950 being exploited?
There is no known exploitation of CVE-2026-5950 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Isc Bind
Sources
Also known as ALPINE-CVE-2026-5950, AZL-87102, BELL-CVE-2026-5950, DEBIAN-CVE-2026-5950, ECHO-42ec-02de-982e, GHSA-2pjm-rchf-gxmp and 2 more.