{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "bind",
    "label": "BIND",
    "isStack": false,
    "url": "https://pwn.watch/t/bind",
    "feed": "https://pwn.watch/t/bind/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 0
  },
  "incidents": [
    {
      "slug": "isc-bind-cve-2026-94300",
      "title": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300",
      "json": "https://pwn.watch/i/isc-bind-cve-2026-94300.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "ISC BIND 9 (named) DNS server",
      "tags": [
        "linux",
        "bind",
        "dns",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-94300"
      ],
      "affectedVersions": [
        "BIND 9.11.0 through 9.18.50",
        "BIND 9.20.0 through 9.20.29",
        "BIND 9.21.0 through 9.21.26",
        "BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1"
      ],
      "fixedVersions": [
        "BIND 9.20.30",
        "BIND 9.21.27",
        "BIND Supported Preview Edition 9.20.30-S1",
        "Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T15:59:23+02:00",
      "summary": "ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Abhay अभय",
      "handle": "abyzz",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2077228355368484867/d6V_ACTZ_bigger.jpg",
      "text": "BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet.\n\nUpgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC.\nhttps://t.co/s2ChkYWdYG",
      "date": "2026-10-22T11:04:54.000Z",
      "url": "https://x.com/abyzz/status/2113225077248741652",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "Hensen Juang",
      "handle": "basedjensen",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2101681466476544000/S_hcWgNC_bigger.jpg",
      "text": "Bruh... DNS infa is fucked. Update your bind boys https://t.co/Gbll8AK5g2 https://t.co/BParNla6y9",
      "date": "2026-10-22T08:39:08.000Z",
      "url": "https://x.com/basedjensen/status/2113188391722627207",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVONoxnaYAAc7W-.jpg"
        }
      ],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "日本レジストリサービス（JPRS）",
      "handle": "JPRS_official",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1335820126499663872/xX3MDdt__bigger.jpg",
      "text": "（緊急）BIND 9.xの脆弱性（DNSサービスの停止・リモートコード実行）について（CVE-2026-94300） - バージョンアップを強く推奨 -\nhttps://t.co/1GT8uIFYT0",
      "date": "2026-10-22T06:41:12.000Z",
      "url": "https://x.com/JPRS_official/status/2113158713569882272",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "ɐʞsǝs",
      "handle": "akses_0x00",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067286904039702533/Q4ky91Ed_bigger.jpg",
      "text": "is it time to turn the internet off yet \nhttps://t.co/RLrPu79z8g",
      "date": "2026-10-22T04:18:08.000Z",
      "url": "https://x.com/akses_0x00/status/2113122707789553888",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    }
  ],
  "changes": [
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable.",
      "body": null,
      "sourceUrl": "https://security-tracker.debian.org/tracker/CVE-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade.",
      "body": null,
      "sourceUrl": "https://x.com/JPRS_official/status/2113158713569882272",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently.",
      "body": null,
      "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-14",
      "title": "ISC sends early notification of the flaw to its customers.",
      "body": null,
      "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    }
  ]
}