DEBIAN-CVE-2026-5947

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-5947

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5947.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-5947

Upstream

CVE-2026-5947

Published

2026-05-20T13:16:40.303Z

Modified

2026-05-23T11:00:08.151969229Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incoming DNS message signed with SIG(0), it begins work to validate that signature. If, during that validation, the "recursive-clients" limit is reached (as would occur during a query flood), and that same DNS message is discarded per the limit, there is a brief window of time while the SIG(0) validation may attempt to read the now-discarded DNS message. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions 9.18.28 through 9.18.49 and 9.18.28-S1 through 9.18.49-S1 are NOT affected.

References

https://security-tracker.debian.org/tracker/CVE-2026-5947

Affected packages

Debian:13 / bind9

Package

Name: bind9
Purl: pkg:deb/debian/bind9?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:9.20.23-1~deb13u1

Affected versions

1:9.*

1:9.20.11-4

1:9.20.15-1~deb13u1~bpo12+1

1:9.20.15-1~deb13u1

1:9.20.15-1

1:9.20.15-2

1:9.20.18-1~deb13u1~bpo12+1

1:9.20.18-1~deb13u1

1:9.20.18-1

1:9.20.19-1~bpo12+1

1:9.20.19-1

1:9.20.20-1~bpo12+1

1:9.20.20-1

1:9.20.21-1~deb13u1~bpo12+1

1:9.20.21-1~deb13u1

1:9.20.21-1

1:9.20.22-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-5947.json"

Debian:14 / bind9