CVE-2026-5946

isc bind

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-5946

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Improper Input Validation pada isc bind. Skor CVSS 3.1 7.5 (High) menurut isc.org.

Deskripsi (NVD)

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Rincian

Terbit di NVD
20 Mei 2026
Terakhir diubah
17 September 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber isc.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-20: Improper Input Validation
CWE-125: Out-of-bounds Read
CWE-617: Reachable Assertion
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-1287: Improper Validation of Specified Type of Input
EPSS (30 hari)
1,7% peluang dieksploitasi; lebih tinggi dari 76,5% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
isc bind Versi 9.11.0 hingga 9.16.50
isc bind Versi 9.18.0 hingga sebelum 9.18.49
isc bind Versi 9.20.0 hingga sebelum 9.20.23
isc bind Versi 9.21.0 hingga sebelum 9.21.22

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.