CVE-2026-5950CWE-606

Unbounded resend loop in BIND 9 resolver

Medium · published May 20, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote unauthenticated attacker to cause severe resource exhaustion by sending queries that trigger specific retry conditions.

This issue affects BIND 9 versions 9.18.36 through 9.18.48, 9.20.8 through 9.20.22, 9.21.7 through 9.21.21, 9.18.36-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.0th percentile
Weakness
CWE-606 · Unchecked Input for Loop Condition
Published
2026-05-20T13:10Z
EPSS history
Timeline
  • 20 MAY 13:10Z
    Unbounded resend loop in BIND 9 resolver
    cvelistv5