Skip to content
Fencer Vulns
high 7.5

CVE-2026-5946 json

Invalid handling of CLASS != IN

published 2026-05-20 5 mo ago modified 2026-09-17 52 d ago also EUVD-2026-31107

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 32:9.18.33-15.el10_2.2
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 32:9.11.4-26.P2.el7_9.21
  • Red Hat Red Hat Enterprise Linux 8 32:9.11.36-16.el8_10.8, 32:9.16.23-0.22.el8_10.6
  • Red Hat Red Hat Enterprise Linux 9 32:9.16.23-40.el9_8.2, 32:9.18.29-14.el9_8.2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 32:9.16.23-18.el9_4.12
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 32:9.16.23-31.el9_6.4
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202609011112-0
  • Red Hat Red Hat Hardened Images 9.18.49-1.hum1
  • bind9 Debian 12 1:9.18.49-1~deb12u2
  • bind9 Debian 13 1:9.20.23-1~deb13u1
  • bind9 Debian 14 1:9.20.23-1

debian advisories DEBIAN-CVE-2026-5946

  • bind9 Ubuntu 22.04 LTS 1:9.18.39-0ubuntu0.22.04.4
  • bind9 Ubuntu 24.04 LTS 1:9.18.39-0ubuntu0.24.04.5
  • bind9 Ubuntu 25.10 1:9.20.11-1ubuntu2.4
  • bind9 Ubuntu 26.04 LTS 1:9.20.18-1ubuntu2.1
  • bind9 Ubuntu Pro 18.04 LTS 1:9.11.3+dfsg-1ubuntu1.19+esm5
  • bind9 Ubuntu Pro 20.04 LTS 1:9.18.30-0ubuntu0.20.04.2+esm2

ubuntu advisories UBUNTU-CVE-2026-5946

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind RHEL 9 32:9.16.23-40.el9_8.2
  • bind-libs RHEL 9 32:9.16.23-40.el9_8.2
  • bind-utils RHEL 9 32:9.16.23-40.el9_8.2
  • bind-chroot RHEL 9 32:9.16.23-40.el9_8.2
  • bind-license RHEL 9 32:9.16.23-40.el9_8.2
  • python3-bind RHEL 9 32:9.16.23-40.el9_8.2
  • bind-dnssec-utils RHEL 9 32:9.16.23-40.el9_8.2
  • bind9.18 RHEL 9 32:9.18.29-14.el9_8.2

red hat advisories RHSA-2026:79160RHSA-2026:60383RHSA-2026:57189RHSA-2026:55441RHSA-2026:24367RHSA-2026:24368

  • bind Multi Linux Manager Tools SLE-Micro-5, Manager Client Tools for SLE Micro 5 9.16.6-150000.12.91.1
  • bind SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 9.16.6-150300.22.59.1
  • bind SLE Module for Server Applications 15 SP7, SLE Module for Basesystem 15 SP7 9.20.23-150700.3.25.1
  • bind SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 9.16.50-150400.5.62.1
  • bind SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 9.16.50-150500.8.38.1
  • bind SLES for SAP applications 16.0, SLES 16.0 9.20.23-160000.1.1
  • bind SLES for SAP 15 SP6, SLES 15 SP6-LTSS 9.18.49-150600.3.26.1

suse advisories SUSE-SU-2026:3517-1SUSE-SU-2026:2779-1SUSE-SU-2026:2673-1SUSE-SU-2026:2676-1SUSE-SU-2026:2617-1SUSE-SU-2026:2616-1

  • bind openSUSE Leap 16.0 9.20.23-160000.1.1
  • bind openSUSE Tumbleweed 9.20.23-1.1

opensuse advisories openSUSE-SU-2026:21123-1openSUSE-SU-2026:10874-1

  • bind AlmaLinux 10 32:9.18.33-15.el10_2.2
  • bind-libs AlmaLinux 10 32:9.18.33-15.el10_2.2
  • bind-utils AlmaLinux 10 32:9.18.33-15.el10_2.2
  • bind-chroot AlmaLinux 10 32:9.18.33-15.el10_2.2
  • bind-license AlmaLinux 10 32:9.18.33-15.el10_2.2
  • bind-dnssec-utils AlmaLinux 10 32:9.18.33-15.el10_2.2
  • bind AlmaLinux 8 32:9.11.36-16.el8_10.8
  • bind-sdb AlmaLinux 8 32:9.11.36-16.el8_10.8

almalinux advisories ALSA-2026:24338ALSA-2026:24339ALSA-2026:24367ALSA-2026:24368ALSA-2026:23360

  • bind Rocky Linux 10 2:9.18.33-15.el10_2.2
  • bind Rocky Linux 9 2:9.16.23-40.el9_8.2
  • bind9.18 Rocky Linux 9 2:9.18.29-14.el9_8.2
  • bind Rocky Linux 8 2:9.11.36-16.el8_10.8
  • bind9.16 Rocky Linux 8 2:9.16.23-0.22.el8_10.6

rocky linux advisories RLSA-2026:24338RLSA-2026:24367RLSA-2026:24368RLSA-2026:24339RLSA-2026:23360

  • bind Alpine 3.21, Alpine 3.20 9.18.49-r0
  • bind Alpine 3.24, Alpine 3.23, Alpine 3.22 9.20.23-r0

alpine advisories ALPINE-CVE-2026-5946

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind Azure Linux 3.0 9.20.23-1

azure linux advisories AZL-87096

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5946 updated cvss 7.5

bind: BIND: Denial of Service via specially crafted DNS messages

  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder EUS (v.9.6) bind-libs 9.16.23-31.el9_6.4, bind9.18-libs 9.18.29-4.el9_6.5
    fixed: vendor fix RHSA-2026:55441
  • Red Hat Enterprise Linux AppStream (v. 8) bind 9.11.36-16.el8_10.8, bind-sdb 9.11.36-16.el8_10.8, bind-libs 9.11.36-16.el8_10.8, bind-utils 9.11.36-16.el8_10.8, bind9.16 9.16.23-0.22.el8_10.6, bind-chroot 9.11.36-16.el8_10.8, +13 more
    fixed: vendor fix RHSA-2026:24339
  • Red Hat Enterprise Linux AppStream (v. 9) bind 9.16.23-40.el9_8.2, bind9.18 9.18.29-14.el9_8.2, bind-libs 9.16.23-40.el9_8.2, bind-utils 9.16.23-40.el9_8.2, bind-chroot 9.16.23-40.el9_8.2, bind-license 9.16.23-40.el9_8.2, +6 more
    fixed: vendor fix RHSA-2026:24367
  • Red Hat Enterprise Linux AppStream (v. 10) bind 9.18.33-15.el10_2.2, bind-libs 9.18.33-15.el10_2.2, bind-utils 9.18.33-15.el10_2.2, bind-chroot 9.18.33-15.el10_2.2, bind-license 9.18.33-15.el10_2.2, bind-dnssec-utils 9.18.33-15.el10_2.2
    fixed: vendor fix RHSA-2026:24338
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) bind 9.11.26-4.el8_4.10, bind-sdb 9.11.26-4.el8_4.10, bind-libs 9.11.26-4.el8_4.10, bind-utils 9.11.26-4.el8_4.10, bind-pkcs11 9.11.26-4.el8_4.10, bind-libs-lite 9.11.26-4.el8_4.10, +2 more
    fixed: vendor fix RHSA-2026:95477
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) bind 9.11.36-3.el8_6.13, bind-sdb 9.11.36-3.el8_6.13, bind-libs 9.11.36-3.el8_6.13, bind-utils 9.11.36-3.el8_6.13, bind9.16 9.16.23-0.7.el8_6.12, bind-chroot 9.11.36-3.el8_6.13, +8 more
    fixed: vendor fix RHSA-2026:95435
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) bind 9.11.36-8.el8_8.11, bind-sdb 9.11.36-8.el8_8.11, bind-utils 9.11.36-8.el8_8.11, bind9.16 9.16.23-0.14.el8_8.9, bind-pkcs11 9.11.36-8.el8_8.11, bind-libs-lite 9.11.36-8.el8_8.11, +3 more
    fixed: vendor fix RHSA-2026:95478
show 28 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) bind 9.16.23-11.el9_2.12, bind-libs 9.16.23-11.el9_2.12
    fixed: vendor fix RHSA-2026:95242
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) bind 9.16.23-18.el9_4.12, bind-libs 9.16.23-18.el9_4.12, bind-utils 9.16.23-18.el9_4.12, bind-chroot 9.16.23-18.el9_4.12, bind-license 9.16.23-18.el9_4.12, python3-bind 9.16.23-18.el9_4.12, +1 more
    fixed: vendor fix RHSA-2026:57189
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) bind 9.18.33-4.el10_0.6, bind-libs 9.18.33-4.el10_0.6
    fixed: vendor fix RHSA-2026:94115
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) bind 9.16.23-31.el9_6.4, bind9.18 9.18.29-4.el9_6.5, bind-libs 9.16.23-31.el9_6.4, bind9.18-libs 9.18.29-4.el9_6.5
    fixed: vendor fix RHSA-2026:55441
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) bind 9.11.26-4.el8_4.10, bind-sdb 9.11.26-4.el8_4.10, bind-libs 9.11.26-4.el8_4.10, bind-utils 9.11.26-4.el8_4.10, bind-pkcs11 9.11.26-4.el8_4.10, bind-libs-lite 9.11.26-4.el8_4.10, +2 more
    fixed: vendor fix RHSA-2026:95477
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) bind 9.11.36-3.el8_6.13, bind-sdb 9.11.36-3.el8_6.13, bind-libs 9.11.36-3.el8_6.13, bind-utils 9.11.36-3.el8_6.13, bind9.16 9.16.23-0.7.el8_6.12, bind-chroot 9.11.36-3.el8_6.13, +8 more
    fixed: vendor fix RHSA-2026:95435
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) bind 9.11.36-8.el8_8.11, bind-sdb 9.11.36-8.el8_8.11, bind-utils 9.11.36-8.el8_8.11, bind9.16 9.16.23-0.14.el8_8.9, bind-pkcs11 9.11.36-8.el8_8.11, bind-libs-lite 9.11.36-8.el8_8.11, +3 more
    fixed: vendor fix RHSA-2026:95478
  • Red Hat Enterprise Linux BaseOS (v. 8) bind 9.11.36-16.el8_10.8, bind-export-libs 9.11.36-16.el8_10.8
    fixed: vendor fix RHSA-2026:24339
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) bind 9.11.26-4.el8_4.10, bind-export-libs 9.11.26-4.el8_4.10
    fixed: vendor fix RHSA-2026:95477
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) bind 9.11.36-3.el8_6.13, bind-export-libs 9.11.36-3.el8_6.13
    fixed: vendor fix RHSA-2026:95435
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) bind 9.11.36-8.el8_8.11, bind-export-libs 9.11.36-8.el8_8.11
    fixed: vendor fix RHSA-2026:95478
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) bind 9.11.26-4.el8_4.10, bind-export-libs 9.11.26-4.el8_4.10
    fixed: vendor fix RHSA-2026:95477
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) bind 9.11.36-3.el8_6.13, bind-export-libs 9.11.36-3.el8_6.13
    fixed: vendor fix RHSA-2026:95435
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) bind 9.11.36-8.el8_8.11, bind-export-libs 9.11.36-8.el8_8.11
    fixed: vendor fix RHSA-2026:95478
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) bind-libs 9.16.23-40.el9_8.2, bind9.18-libs 9.18.29-14.el9_8.2
    fixed: vendor fix RHSA-2026:24367
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) bind-doc 9.18.33-15.el10_2.2, bind-devel 9.18.33-15.el10_2.2, bind-debuginfo 9.18.33-15.el10_2.2, bind-debugsource 9.18.33-15.el10_2.2, bind-libs-debuginfo 9.18.33-15.el10_2.2, bind-utils-debuginfo 9.18.33-15.el10_2.2, +1 more
    fixed: vendor fix RHSA-2026:24338
  • Red Hat Enterprise Linux CRB (v. 8) bind9.16-libs 9.16.23-0.22.el8_10.6
    fixed: vendor fix RHSA-2026:23360
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) bind 9.8.2-0.68.rc1.el6_10.20, bind-libs 9.8.2-0.68.rc1.el6_10.20
    fixed: vendor fix RHSA-2026:95727
  • Red Hat Enterprise Linux Server (v. 7 ELS) bind 9.11.4-26.P2.el7_9.21, bind-pkcs11 9.11.4-26.P2.el7_9.21, bind-libs-lite 9.11.4-26.P2.el7_9.21, bind-export-libs 9.11.4-26.P2.el7_9.21, bind-pkcs11-libs 9.11.4-26.P2.el7_9.21
    fixed: vendor fix RHSA-2026:60383
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) bind-sdb 9.8.2-0.68.rc1.el6_10.20
    fixed: vendor fix RHSA-2026:95727
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) bind-sdb 9.11.4-26.P2.el7_9.21
    fixed: vendor fix RHSA-2026:60383
  • Red Hat Hardened Images bind 9.18.49-1.hum1, bind-libs 9.18.49-1.hum1, bind-utils 9.18.49-1.hum1, bind-chroot 9.18.49-1.hum1, bind-dnssec-utils 9.18.49-1.hum1
    fixed: vendor fix RHSA-2026:20334
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202609011112
    fixed: vendor fix RHSA-2026:62549
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202609191027
    fixed: vendor fix RHSA-2026:70586
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202609031320, rhcos 418.94.202609171815
    fixed: vendor fix RHSA-2026:65851
  • Red Hat CodeReady Linux Builder EUS (v.9.6) bind-doc 9.16.23-31.el9_6.4, bind-devel 9.16.23-31.el9_6.4, bind9.18-doc 9.18.29-4.el9_6.5, bind9.18-devel 9.18.29-4.el9_6.5, bind-debuginfo 9.16.23-31.el9_6.4, bind-debugsource 9.16.23-31.el9_6.4, +8 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 9 dhcp, dhcp-relay, dhcp-client, dhcp-common, dhcp-server
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) bind-chroot 9.11.26-4.el8_4.10, bind-license 9.11.26-4.el8_4.10, python3-bind 9.11.26-4.el8_4.10, bind-sdb-chroot 9.11.26-4.el8_4.10 Red Hat Enterprise Linux AppStream AUS (v.8.6) bind9.16-utils 9.16.23-0.7.el8_6.12, bind9.16-chroot 9.16.23-0.7.el8_6.12, bind9.16-license 9.16.23-0.7.el8_6.12 Red Hat Enterprise Linux AppStream E4S (v.8.8) bind-libs 9.11.36-8.el8_8.11, bind-chroot 9.11.36-8.el8_8.11, bind-license 9.11.36-8.el8_8.11, python3-bind 9.11.36-8.el8_8.11, bind-sdb-chroot 9.11.36-8.el8_8.11, bind9.16-utils 9.16.23-0.14.el8_8.9, +4 more Red Hat Enterprise Linux AppStream E4S (v.9.2) bind-utils 9.16.23-11.el9_2.12, bind-chroot 9.16.23-11.el9_2.12, bind-license 9.16.23-11.el9_2.12, python3-bind 9.16.23-11.el9_2.12, bind-dnssec-utils 9.16.23-11.el9_2.12 Red Hat Enterprise Linux AppStream EUS (v. 10.0) bind-utils 9.18.33-4.el10_0.6, bind-chroot 9.18.33-4.el10_0.6, bind-license 9.18.33-4.el10_0.6, bind-dnssec-utils 9.18.33-4.el10_0.6
    not affected: vulnerable code not present

13 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • ISC BIND 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-125 Out-of-bounds Read
  • CWE-617 Reachable Assertion
  • CWE-754 Improper Check for Unusual or Exceptional Conditions
  • CWE-843 Access of Resource Using Incompatible Type
  • CWE-1287 Improper Validation of Specified Type of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.