BIND DNS Vulnerability CVE-2026-5947: Race Condition Leads to Use-After-Free

The National Vulnerability Database has detailed CVE-2026-5947, a critical vulnerability in BIND 9 affecting versions 9.20.0 through 9.20.22 and 9.21.0 through 9.21.21. This flaw stems from a race condition during the validation of DNS messages signed with SIG(0). If a query flood triggers the “recursive-clients” limit, the system may discard a message while its signature validation is still in progress, leading to a use-after-free error. This could allow an attacker to crash the BIND service, causing a denial-of-service.

This high-severity (CVSS 7.5) vulnerability, categorized under CWE-362 (Race Condition) and CWE-416 (Use-After-Free), presents a tangible risk to organizations relying on BIND for DNS resolution. The attacker’s calculus here is straightforward: flood BIND servers beyond their capacity to trigger the race condition and achieve a denial-of-service. The impact is direct — DNS resolution failure means service disruption and potential network outages. Defenders must prioritize patching affected BIND 9 versions immediately. Older, unaffected versions like 9.18.x should also be considered for upgrade paths.