CVE-2026-5946

Invalid handling of CLASS != IN

HIGH

7.5

CVSS Score

Published: May 20, 2026 at 01:10 PM UTC

Updated: September 17, 2026 at 12:43 PM UTC

3 products affected across 2 vendorsBINDEnterprise LinuxOpenShift Container Platform

Using BIND 9 by ISC?

Get instant alerts when new vulnerabilities affect BIND 9 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

BIND · Isc

95%

9.11.0 ≤ v ≤ 9.16.509.11.3-S1 ≤ v ≤ 9.16.50-S19.18.0 ≤ v ≤ 9.18.489.18.0 ≤ v < 9.18.499.18.11-S1 ≤ v ≤ 9.18.48-S19.20.0 ≤ v ≤ 9.20.229.20.0 ≤ v < 9.20.239.20.9-S1 ≤ v ≤ 9.20.22-S19.21.0 ≤ v ≤ 9.21.219.21.0 ≤ v < 9.21.229.11.0 9.11.3-S1 9.18.0 9.18.11-S1 9.20.0 9.20.9-S1 9.21.0

Affected range stops below 9.18.49, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.20.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.21.22, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 32:9.11.36-16.el8_10.8 (unaffected)

Vendor states this is fixed in 32:9.11.4-26.P2.el7_9.21 (unaffected)

Vendor states this is fixed in 32:9.16.23-0.22.el8_10.6 (unaffected)

Vendor states this is fixed in 32:9.16.23-18.el9_4.12 (unaffected)

Vendor states this is fixed in 32:9.16.23-31.el9_6.4 (unaffected)

Vendor states this is fixed in 32:9.16.23-40.el9_8.2 (unaffected)

Vendor states this is fixed in 32:9.18.29-14.el9_8.2 (unaffected)