CVE-2026-94300 – BIND 9: Memory Corruption with Possible Code Execution
Replayed GSS-TSIG-signed DNS messages can corrupt the memory of the BIND DNS server and, in the worst case, allow code to be injected. The same update from ISC closes three further flaws that can take DNS servers down.
What happened?
On October 21, the Internet Systems Consortium (ISC) released updates for the widely used BIND 9 DNS server. The most serious flaw affects GSS-TSIG – the mechanism used to sign DNS messages in Kerberos and Active Directory environments:
- CVE-2026-94300 (CVSS 8.1): An attacker who has captured a signed DNS message can replay it while the negotiated key is still valid. This corrupts the memory of the named process; combined with crafted queries to a zone the attacker controls, code execution is possible.
- Three further flaws (CVSS 7.5 each): Crafted DNS messages or certain query patterns can overload resolvers or make them crash.
Exploiting CVE-2026-94300 is complex, and ISC is not aware of any attacks so far. There are no workarounds – only the update closes the flaws.
Who is affected?
- Companies running their own BIND DNS server: BIND 9.11 to 9.18.50, 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26.
- Particularly exposed: Environments using GSS-TSIG, such as signed dynamic DNS updates together with Active Directory or Kerberos.
- Resolvers: Recursive DNS servers, especially when reachable from the internet (denial-of-service risk from the further flaws).
- Older systems: No fixed version is available for BIND 9.18 and older.
What needs to be done?
- Update: Upgrade to BIND 9.20.30 or 9.21.27, or install the security update from your Linux distribution.
- Plan the migration: Move systems running BIND 9.18 or older to 9.20 promptly.
- Review GSS-TSIG: Is it actually needed? Only allow dynamic updates from trusted networks (configure
allow-updateorupdate-policyrestrictively). - Reduce the attack surface: Do not expose recursive resolvers to the internet and restrict queries to internal networks.
- Monitor: Investigate unexpected crashes or restarts of named in the logs.
This advisory is for informational purposes. For support in securing your DNS infrastructure, contact us.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call