Invalid handling of CLASS != IN

Description

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Scores

EPSS (exploitation in 30 days)

1.9% · top 20% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-20 Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs
• CWE-125 Out-of-bounds Read (opens in a new tab)All about CWE-125 and its CVEs
• CWE-617 Reachable Assertion (opens in a new tab)All about CWE-617 and its CVEs
• CWE-754 Improper Check for Unusual or Exceptional Conditions (opens in a new tab)All about CWE-754 and its CVEs
• CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') (opens in a new tab)All about CWE-843 and its CVEs
• CWE-1287: Improper Validation of Specified Type of Input (opens in a new tab)All about CWE-1287 and its CVEs

Affected products

• ISC · BIND 9

  • affected 9.11.0 – ≤ 9.16.50
  • affected 9.18.0 – ≤ 9.18.48
  • affected 9.20.0 – ≤ 9.20.22
  • affected 9.21.0 – ≤ 9.21.21
  • affected 9.11.3-S1 – ≤ 9.16.50-S1
  • affected 9.18.11-S1 – ≤ 9.18.48-S1
  • affected 9.20.9-S1 – ≤ 9.20.22-S1

What to do

Solution: Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.49, 9.20.23, 9.21.22, 9.18.49-S1, or 9.20.23-S1.

Workaround: Don't configure zones other than Internet (`IN`) class. Furthermore, do not expose the server that allows DNS Dynamic Update to the general Internet.

Exploitation: We are not aware of any active exploits.

References (18)

• CVE-2026-5946 (opens in a new tab)vendor-advisory
• https://downloads.isc.org/isc/bind9/9.18.49 (opens in a new tab)patch
• https://downloads.isc.org/isc/bind9/9.20.23 (opens in a new tab)patch
• https://downloads.isc.org/isc/bind9/9.21.22 (opens in a new tab)patch
• https://access.redhat.com/security/cve/CVE-2026-5946 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2479771 (opens in a new tab)issue-trackingx_refsource_REDHAT
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5946.json (opens in a new tab)x_sadp-csaf-vex
• https://access.redhat.com/errata/RHSA-2026:60383 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:62549 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:65851 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24338 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24339 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:23360 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:57189 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:55441 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24367 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:24368 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:20334 (opens in a new tab)vendor-advisoryx_refsource_REDHAT

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-5946](https://trackcve.app/badge/CVE-2026-5946.svg)](https://trackcve.app/cve/CVE-2026-5946)

Record last updated 17 Sept 2026, 12:04 UTC.