CVE WatchJul 15, 2026

CVE-2026-5946

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CH

CVSS

7.5

High

EPSS

1.8%

p76

KEV

—

Exploit Today

0-100

Published: May 20, 2026 · Last modified: Jul 15, 2026 · CWE-20 · CWE-125 · CWE-617

EPSS · 30d

1.8%EPSS · 30 days1.8%

2026-06-302026-07-16

Technical description

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2d CVE-2025-105859.8 CRI

91.8%

KEV—78Google Chromium V8 Type Confusion Vulnerability2d CVE-2025-132238.8 HIG

91.1%

KEV—77Google Chromium V8 Type Confusion Vulnerability2d CVE-2026-125699.8 CRI

66.0%

KEV—70PTC Windchill and FlexPLM Improper Input Validation Vulnerability16d CVE-2026-217107.5 HIG

97.8%

——29A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**2d CVE-2025-607877.2 HIG

97.0%

——29MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.12d