{"id":"CVE-2026-5946","title":"Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question sec…","summary":"Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question sec…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-20","CWE-125","CWE-617","CWE-754","CWE-843","CWE-1287"],"vendor":"isc","product":"bind","affected":["bind >= 9.11.0, <= 9.16.50","bind >= 9.18.0, < 9.18.49","bind >= 9.20.0, < 9.20.23","bind >= 9.21.0, < 9.21.22"],"patched":["bind 9.21.22"],"published":"2026-05-20","updated":"2026-09-17","sourceUpdated":"2026-09-17T12:18:24.927","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5946","references":[{"url":"https://downloads.isc.org/isc/bind9/9.18.49","label":"security-officer@isc.org"},{"url":"https://downloads.isc.org/isc/bind9/9.20.23","label":"security-officer@isc.org"},{"url":"https://downloads.isc.org/isc/bind9/9.21.22","label":"security-officer@isc.org"},{"url":"https://kb.isc.org/docs/cve-2026-5946","label":"security-officer@isc.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:20334","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23360","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24338","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24339","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24367","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24368","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:55441","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57189","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60383","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:62549","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:65851","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-5946","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479771","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5946.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5946"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5946"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-05-20T13:40:04.619504Z"},"epss":0.01874,"epssPercentile":0.78161,"ingestedAt":"2026-07-23T12:17:54.885Z","slug":"CVE-2026-5946","body":"## Overview\n\nMultiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`.\nThis issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.\n\n## Affected\n\n- `bind >= 9.11.0, <= 9.16.50`\n- `bind >= 9.18.0, < 9.18.49`\n- `bind >= 9.20.0, < 9.20.23`\n- `bind >= 9.21.0, < 9.21.22`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `bind 9.21.22`\n\n## Vendor advisories\n\n- **RHSA-2026:60383** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60383)\n- **RHSA-2026:62549** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:62549)\n- **RHSA-2026:24338** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24338)\n- **RHSA-2026:24339** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24339)\n- **RHSA-2026:23360** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23360)\n- **RHSA-2026:57189** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57189)\n- **RHSA-2026:55441** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55441)\n- **RHSA-2026:24367** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24367)\n- **RHSA-2026:24368** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24368)\n- **RHSA-2026:20334** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20334)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5946.json)\n- **RHSA-2026:65851** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65851)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}