BIND CVE-2026-5947: SIG Validation Race Condition Leading to UAF

CVE-2026-5947: Query Flood During SIG(O) Validation May Lead to Undefined Behavior Vulnerability Overview Title: SIG(O) validation during query flood may lead to undefined behavior Severity: High Exploitation Vector: Remotely CVSS Score: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description: A use-after-free vulnerability caused by a race condition. When BIND receives an incoming DNS message signed with a SIG(O) signature, it begins validating that signature. If the limit is reached during validation (as occurs during a query flood) and the same DNS message is dropped due to exceeding that limit, there is a brief time window between the dropping of the DNS message and the SIG(O) validation attempt to read the dropped DNS message. Impact: Use-after-free results in undefined behavior ("dangling pointer"). The BIND process may abort due to a segmentation fault or other similar errors. If the memory from the dropped message is not reused or recycled, the validation may proceed normally. Code execution resulting from such improper data reads is unlikely. Affected Servers: - Authoritative servers - Resolvers Known Exploits: None (We are not aware of any active exploits) Impact Scope Affected Versions: - BIND 9.20.0 -> 9.20.22 - BIND 9.21.0 -> 9.21.21 BIND Support Preview Versions Affected: - BIND 9.20.9-S1 -> 9.20.22-S1 Unaffected Versions: - BIND 9.10.20 -> 9.10.40 Remediation Workarounds: No known workarounds Solution: Upgrade to the closest patched version of your current BIND 9 release: - BIND 9.20.23 - BIND 9.21.22 - BIND 9.20.9-S1 (BIND Support Preview)

Goal Reached Thanks to every supporter — we hit 100%!

BIND CVE-2026-5947: SIG Validation Race Condition Leading to UAF