Is CVE-2026-5947 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5947 being exploited in the wild.

How severe is CVE-2026-5947?

High severity, with a CVSS score of 7.5, published 20 May 2026.

Which products and versions are affected?

Isc BIND 9 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1.

Is there a fix for CVE-2026-5947?

A patch was published on 2026-05-20: Fixed versions 9.20.23 and 9.21.22 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5947 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-5947?

Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5947: ISC BIND 9 use-after-free in SIG(0) validation during query flood

CVE-2026-5947 · Severity: high · CVSS 7.5 · Published 2026-05-20

ISC BIND 9, a widely used DNS server suite, is vulnerable to a race condition that can cause the service to crash. An attacker can trigger this by sending specific DNS messages during a high-traffic query flood, potentially leading to a denial-of-service (DoS) condition. This impact can disrupt internet connectivity or internal network name resolution for organizations relying on affected versions.

Technologies: Isc BIND 9. Vendors: Isc.

Quick answers

Is CVE-2026-5947 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5947 being exploited in the wild.
How severe is CVE-2026-5947?: High severity, with a CVSS score of 7.5, published 20 May 2026.
Which products and versions are affected?: Isc BIND 9 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1.
Is there a fix for CVE-2026-5947?: A patch was published on 2026-05-20: Fixed versions 9.20.23 and 9.21.22 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5947 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-5947?: Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in BIND 9's handling of SIG(0) signed DNS messages. When BIND receives such a message, it initiates signature validation; however, if the 'recursive-clients' limit is reached simultaneously (e.g., during a query flood), the message may be discarded while the validation process still attempts to read it. This results in a use-after-free (UAF) violation. An unauthenticated remote attacker can exploit this to cause the BIND process to abort with a segmentation violation, resulting in a denial-of-service. The vulnerability affects both authoritative servers and resolvers. Patches are available in versions 9.20.23 and 9.21.22.

Affected products

ISC BIND 9 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.20.9-S1 through 9.20.22-S1

Timeline

2026-05-13: other: Early Notification
2026-05-20: advisory: Public disclosure by ISC
2026-05-20: patched: Fixed versions 9.20.23 and 9.21.22 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.