ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)
ISC BIND 9 (named) DNS server
ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.
Why this severity: CVSS 8.1 (AV:N/AC:H/PR:N/UI:N), remotely exploitable, no workaround; ISC unaware of active exploits
- Started
- Oct 21, 2026
Affected
- BIND 9.11.0 through 9.18.50
- BIND 9.20.0 through 9.20.29
- BIND 9.21.0 through 9.21.26
- BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1
Fixed in
- BIND 9.20.30
- BIND 9.21.27
- BIND Supported Preview Edition 9.20.30-S1
- Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1
Timeline4
Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable.
SourceJapan's registry JPRS issues an urgent alert telling BIND operators to upgrade.
SourceISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently.
SourceISC sends early notification of the flaw to its customers.
Source
Advisories4
Posts4
Bruh... DNS infa is fucked. Update your bind boys t.co/Gbll8AK5g2 t.co/BParNla6y9
is it time to turn the internet off yet t.co/RLrPu79z8g
（緊急）BIND 9.xの脆弱性（DNSサービスの停止・リモートコード実行）について（CVE-2026-94300） - バージョンアップを強く推奨 - t.co/1GT8uIFYT0
BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet. Upgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC. t.co/s2ChkYWdYG
Notes & caveats
Primary source is ISC's advisory (document version 2.0). ISC lists 9.18.x as affected but names no 9.18 fix; 9.18 users should move to 9.20.30 or wait for their distro's backport. Ubuntu's last bind9 update (USN-8929-1, Oct 14) predates this CVE. Red Hat status not checked. ISC released the same versions alongside other BIND CVEs (CVE-2026-19630, CVE-2026-96888, CVE-2026-97313) not tracked here.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
