--- id: CVE-2026-5946 title: >- Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question sec… summary: >- Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question sec… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-20 - CWE-125 - CWE-617 - CWE-754 - CWE-843 - CWE-1287 vendor: isc product: bind affected: - 'bind >= 9.11.0, <= 9.16.50' - 'bind >= 9.18.0, < 9.18.49' - 'bind >= 9.20.0, < 9.20.23' - 'bind >= 9.21.0, < 9.21.22' patched: - bind 9.21.22 published: '2026-05-20' updated: '2026-09-17' sourceUpdated: '2026-09-17T12:18:24.927' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5946' references: - url: 'https://downloads.isc.org/isc/bind9/9.18.49' label: security-officer@isc.org - url: 'https://downloads.isc.org/isc/bind9/9.20.23' label: security-officer@isc.org - url: 'https://downloads.isc.org/isc/bind9/9.21.22' label: security-officer@isc.org - url: 'https://kb.isc.org/docs/cve-2026-5946' label: security-officer@isc.org - url: 'https://access.redhat.com/errata/RHSA-2026:20334' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23360' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24338' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24339' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24367' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24368' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:55441' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:57189' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60383' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:62549' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:65851' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-5946' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2479771' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5946.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-5946' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5946' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-05-20T13:40:04.619504Z' epss: 0.01874 epssPercentile: 0.78483 ingestedAt: '2026-07-23T12:17:54.885Z' --- ## Overview Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1. ## Affected - `bind >= 9.11.0, <= 9.16.50` - `bind >= 9.18.0, < 9.18.49` - `bind >= 9.20.0, < 9.20.23` - `bind >= 9.21.0, < 9.21.22` ## Remediation Upgrade past the affected range: - `bind 9.21.22` ## Vendor advisories - **RHSA-2026:60383** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60383) - **RHSA-2026:62549** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:62549) - **RHSA-2026:24338** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24338) - **RHSA-2026:24339** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24339) - **RHSA-2026:23360** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:23360) - **RHSA-2026:57189** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57189) - **RHSA-2026:55441** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-08-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:55441) - **RHSA-2026:24367** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24367) - **RHSA-2026:24368** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-06-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:24368) - **RHSA-2026:20334** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20334) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5946.json) - **RHSA-2026:65851** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65851)