VDB
CVE-2026-5950
CVE-2026-5950
PUBLISHED
CVSS 5.300000190734863 MEDIUM
An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions. This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
EPSS 0.14% · 34.3th percentile
Risk Scores
CVSS v3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.14%
34.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| isc | bind | 9.18.36, 9.20.8, 9.21.7 |
| ISC | BIND 9 | 9.18.36, 9.20.8, 9.21.7 |
Timeline
- May 20, 2026 CVE Published
- May 20, 2026 CVE Updated
- May 20, 2026 PoC Published
- May 20, 2026 PoC Published
- May 21, 2026 EPSS Score
- May 21, 2026 Coalition ESS Score
- May 21, 2026 Security Advisory
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score