CVE-2026-94300
Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in BIND via GSS-TSIG Replay

Publication date: 2026-10-21

Last updated on: 2026-10-26

Assigner: Internet Systems Consortium (ISC)

Description
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-26
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-94300
EUVD
EUVD-2026-107254

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
ISC BIND 9 9.11.0
ISC BIND 9 9.20.0
ISC BIND 9 9.21.0
ISC BIND 9 9.11.3-S1
ISC BIND 9 9.20.9-S1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94300 is a vulnerability in BIND 9 DNS software where replaying GSS-TSIG signed UDP messages can cause memory corruption in the named process. An attacker captures a valid signed UDP message and replays it while the TSIG key is still active. By sending crafted queries to a zone they control, the attacker may achieve remote code execution.

Detection Guidance

Detecting this vulnerability requires checking if your BIND 9 version is within the affected range (9.11.0-9.18.50, 9.20.0-9.20.29, 9.21.0-9.21.26). Use commands like 'named -v' or check package managers (e.g., 'rpm -qa | grep bind' or 'dpkg -l | grep bind'). Monitor named logs for unusual activity or crashes.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code remotely on systems running vulnerable BIND 9 versions. It could lead to unauthorized access, data breaches, service disruption, or complete system compromise. Organizations using affected BIND 9 versions are at risk of DNS server compromise.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized remote code execution through memory corruption in BIND 9's named process. Exploitation may lead to data breaches, unauthorized access, or service disruption, which are critical violations under these regulations.

Mitigation Strategies

Upgrade BIND 9 to a patched version: 9.20.30, 9.21.27, or their Supported Preview Edition equivalents. Download from ISC's official site (e.g., https://downloads.isc.org/isc/bind9/9.20.30 or https://downloads.isc.org/isc/bind9/9.21.27). Restart the named service after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...