PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5947 ISC CVE debrief

CVE-2026-5947 is a high-severity denial-of-service issue in affected BIND 9 releases. According to ISC’s advisory referenced by NVD, a race condition during SIG(0) signature validation can create a brief use-after-free window if the recursive-clients limit is reached and the same DNS message is discarded while validation is still in progress. The issue affects BIND 9 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1, while 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are not affected.

Vendor
ISC
Product
BIND 9
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-08-24
Advisory published
2026-05-20
Advisory updated
2026-08-24

Who should care

Operators and administrators running affected BIND 9 DNS servers, especially systems that may be exposed to query floods or other high-load conditions. Security teams should also care because the flaw is reachable over the network and primarily impacts availability.

Technical summary

NVD lists the issue as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The described condition involves SIG(0) validation work that can outlive the DNS message object when recursive-clients exhaustion causes the message to be dropped. ISC classifies the weaknesses as CWE-362 (race condition) and CWE-416 (use-after-free). The referenced fixed releases are 9.20.23 and 9.21.22.

Defensive priority

High. The vulnerability is network-reachable, requires no privileges or user interaction, and can cause service interruption. Prioritize patching affected BIND 9 deployments.

Recommended defensive actions

  • Upgrade affected BIND 9 installations to a fixed release: 9.20.23 or 9.21.22, as applicable to your branch.
  • Confirm whether any deployed instances are on affected versions 9.20.0-9.20.22, 9.21.0-9.21.21, 9.20.9-S1-9.20.22-S1.
  • Verify that instances on 9.18.28-9.18.49 or 9.18.28-S1-9.18.49-S1 are on an unaffected branch.
  • Review ISC’s advisory for CVE-2026-5947 for any vendor guidance tied to your deployment.
  • If immediate patching is not possible, closely monitor affected servers for high query load or resource exhaustion conditions and reduce exposure where feasible.

Evidence notes

All factual claims are based on the NVD record and ISC-linked references supplied in the source corpus. The CVE was published and last modified on 2026-05-20, and NVD marks the vulnerability status as "Undergoing Analysis". The source references point to ISC downloads for 9.20.23 and 9.21.22 and to the ISC knowledge base advisory for CVE-2026-5947.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5947 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5947

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5947 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5947

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.