CVE-2026-5946

Vulnerability

Multiple flaws in named affect handling of DNS messages whose CLASS is not Internet (IN), such as CHAOS, HESIOD, or meta-classes ANY/NONE. Specially crafted requests reaching recursion, dynamic updates (UPDATE), zone change notifications (NOTIFY), or processing of IN-specific record types in non-IN data can cause assertion failures. Affected versions: BIND 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and corresponding Supported Preview Edition versions [1].

Exploitation

An attacker can send specially crafted DNS messages to an affected named instance without authentication or user interaction. The messages must reach one of the vulnerable code paths (recursion, dynamic update, NOTIFY, or processing of IN-specific records in non-IN data). No special network position is required beyond the ability to send DNS queries to the target server [1].

Impact

Successful exploitation causes named to terminate unexpectedly due to an assertion failure, resulting in a denial of service (DoS). The vulnerability does not lead to information disclosure, privilege escalation, or remote code execution. Both authoritative servers and resolvers are affected [1].

Mitigation

Upgrade to patched releases: BIND 9.18.49, 9.20.23, or 9.21.22 (and corresponding Supported Preview Edition versions 9.18.49-S1, 9.20.23-S1) [1][2][3][4]. As a workaround, do not configure zones other than Internet (IN) class, and avoid exposing servers that allow DNS Dynamic Update to the general Internet [1]. No active exploits are known [1].