Medium severity5.3NVD Advisory· Published May 20, 2026· Updated May 21, 2026

CVE-2026-5950

Description

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Isc/Bind9inferred
Range: >=9.18.36,<=9.18.48 || >=9.20.8,<=9.20.22 || >=9.21.7,<=9.21.21 || >=9.18.36-S1,<=9.18.48-S1 || >=9.20.9-S1,<=9.20.22-S1
Isc/Bind2 versions
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*range: >=9.18.36,<9.18.49
- (no CPE)range: >=9.18.36 <=9.18.48, >=9.20.8 <=9.20.22, >=9.21.7 <=9.21.21, >=9.18.36-S1 <=9.18.48-S1, >=9.20.9-S1 <=9.20.22-S1
osv-coords3 versions
pkg:rpm/opensuse/bind&distro=openSUSE%20Tumbleweed pkg:rpm/suse/bind&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/bind&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 9.20.23-1.1+ 2 more
- (no CPE)range: < 9.20.23-1.1
- (no CPE)range: < 9.20.23-160000.1.1
- (no CPE)range: < 9.20.23-160000.1.1

Patches

Vulnerability mechanics

References

downloads.isc.org/isc/bind9/9.18.49nvdPatch
downloads.isc.org/isc/bind9/9.20.23nvdPatch
downloads.isc.org/isc/bind9/9.21.22nvdPatch
kb.isc.org/docs/cve-2026-5950nvdVendor Advisory

News mentions

BIND 9 Software Vulnerabilities Exposes Resolvers and Authoritative Servers to Remote Exploits
Cyber Security News · May 27, 2026

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000