A replayed GSS-TSIG message can corrupt BIND 9 memory and lead to remote code execution

14 October 2026. ISC gives early notice to customers about a flaw found during internal testing in BIND 9. 21 October 2026. The public advisory lands: CVE-2026-94300, scored 8.1, lets an attacker corrupt the memory of named by replaying a GSS-TSIG-signed UDP message. The part that matters: there is no workaround, so the only fix is upgrading to 9.20.30 or 9.21.27.

Who is actually exposed: Active Directory-integrated zones

BIND is the Internet’s reference DNS server, running on a large share of resolvers and authoritative servers. But CVE-2026-94300 does not hit just any server: it targets those that accept GSS-TSIG-signed dynamic updates.

GSS-TSIG (RFC 3645) is the mechanism that authenticates dynamic DNS updates with Kerberos. It is what Windows Server uses for Active Directory-integrated zones, when hosts and domain controllers register their records securely. A BIND server that fronts such a zone — for example sitting in front of an AD domain or relaying secure updates — is the natural target of this flaw. A server doing only recursive resolution or static authoritative service, with no GSS-TSIG configured, does not expose this attack path.

The affected range covers most of the installed base: 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26, plus the Supported Preview Edition branch (9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1). In short, almost everything not upgraded since 21 October.

The mechanics: replaying a message that is already signed

The attack ISC describes comes down to three moves. First, the attacker captures a previously signed GSS-TSIG UDP message — which requires a privileged network position or a man-in-the-middle. Second, they replay it while the negotiated TSIG key remains valid, without ever needing to break the key: the signature already exists. Third, they send crafted queries to a zone they control.

It is the concurrency between these replayed messages that corrupts named’s memory. The ISC advisory is blunt: “Replaying GSS-TSIG signed UDP messages can result in memory corruption in named,” with an impact of “memory corruption, leading to program abort and/or potential remote code execution.”

The CVSS 3.1 vector captures that combination: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachable, no authentication, no clicks — but high attack complexity (AC:H), which encodes the twin conditions: you must have captured a valid message, and you must control a zone to receive the crafted queries.

No workaround, one way out

This is the heaviest sentence in the advisory. ISC writes it plainly: “No workarounds known.” No configuration directive to disable, no access-control list to tighten, no stopgap: the only remedy is the upgrade.

The fixed releases are 9.20.30 and 9.21.27 — plus 9.20.30-S1 for the Supported Preview Edition branch. The versioning is simple: 9.20 and 9.21 are the two currently maintained branches, while older ones (9.18 and below) are end-of-life and not patched by ISC.

# Check the installed version and branch
named -V | head -1

# Upgrade within your branch (Debian/Ubuntu example)
apt-get update && apt-get install --only-upgrade bind9 bind9-utils

# Then confirm the service runs the patched binary
named -v
systemctl restart named

That constraint has an operational consequence DNS teams often miss: unlike a temporary workaround, a BIND upgrade cannot be postponed. It belongs in the nearest maintenance window — all the more so because ISC published two further advisories in the same batch: CVE-2026-19630 (amplified resource exhaustion in inbound message processing) and CVE-2026-96888 (named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization).

A real flaw, a demanding exploit

Let’s be honest about the threat level. CVE-2026-94300 is not a mass-scale zero-click: the attacker must capture a signed message, which already implies a position on the network path, and control a zone to receive the crafted queries. ISC also says it is “not aware of any active exploits” at publication time.

But that should not be falsely reassuring. First, BIND is a prime target: it is the infrastructure that resolves entire namespaces, and code execution on a resolver or authoritative server opens the door to forged answers, traffic redirection, or a pivot into the rest of the network. Second, the attackers who target this kind of system have exactly the means to sit on the path and control a zone — this is the profile of a state actor or a specialised group, not an opportunistic script. Third, the absence of known exploitation today is a snapshot: once the mechanism is public, the technical bar drops for everyone.

The discovery even has a double origin story. ISC says it found the flaw during internal testing, but it also thanks Dave Aitel of OpenAI, who “independently discovered and responsibly reported” it. Two teams finding the same flaw in parallel is often a sign it was ripe for the finding.

Verdict

If you run BIND 9 on a 9.20 or 9.21 branch, schedule the upgrade to 9.20.30 or 9.21.27 now: there is no workaround, and delaying only prolongs a window in which the single remedy is not applied. If your servers front Active Directory-integrated zones or accept GSS-TSIG dynamic updates, treat this CVE as top priority: that is precisely the population the flaw targets, and code execution on a domain’s DNS front-end costs far more than an outage. And if you are still on 9.18 or older, the advisory is a reminder: those versions are out of support and will receive no fix — moving to 9.20 or 9.21 is no longer an option, it is a security obligation. CVE-2026-94300 is not the easiest flaw to exploit this year; it is proof that, on DNS, even a “demanding” flaw gets fixed by upgrading — because there is nothing else to do.

Références

• ISC — CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory (21 October 2026)
• NVD — CVE-2026-94300
• ISC — CVE-2026-19630: Amplified resource exhaustion in inbound message processing
• ISC — CVE-2026-96888: named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
• Safeguard.sh — BIND 9 CVE-2026-94300: GSS-TSIG Replay Memory Corruption Explained