The Internet Systems Consortium (ISC) on Wednesday released patches for a high-severity BIND 9 vulnerability that can crash the named DNS server and, under the right conditions, let a remote attacker execute code on it.
Tracked as CVE-2026-94300 with a CVSS score of 8.1, the flaw sits in BIND’s handling of GSS-TSIG, a Kerberos-based authentication layer for DNS transactions. According to ISC’s advisory , it affects every BIND release from 9.11.0 onward: versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26, along with Supported Preview Edition builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1.
ISC fixed the issue in BIND 9.20.30, 9.21.27 and 9.20.30-S1. The organization said it is not aware of any active exploitation, and no workaround exists.
Japan Registry Services (JPRS), operator of the .jp registry, labelled the bug urgent on Thursday, warning of both DNS service disruption and remote code execution and strongly recommending an immediate upgrade. The Canadian Centre for Cyber Security also issued an alert (AV26-1072) covering the release.
How does the BIND GSS-TSIG vulnerability work?
TSIG, defined in RFC 8945, adds a digital signature to DNS messages so a server can verify who sent them. GSS-TSIG, defined in RFC 3645, connects TSIG to the GSS-API so those signatures can rely on Kerberos. It is most often used for authenticated dynamic DNS updates in networks that integrate BIND with Active Directory.
When a client and server set up a GSS-TSIG session, they negotiate a key through the TKEY mechanism and name shares that session across every message signed or verified with the key.
According to Linux Compatible , concurrent signed messages could corrupt that shared Kerberos state, and the fix, tracked as ISC GitLab issue #6320, serialises access to it.
ISC describes the attack as a replay. An attacker who captures a previously signed UDP message can resend it while the negotiated key is still valid, which can corrupt memory in named and abort the process. If the attacker also sends crafted queries to a zone they control, the corruption can potentially be turned into remote code execution. The CVE record classifies the bug as a race condition (CWE-362) and a double free (CWE-415).
Attack complexity is rated high because the attacker must obtain a legitimately signed message and act within the key’s lifetime. No privileges or user interaction are required, however, and a successful attack has a high impact on confidentiality, integrity and availability.
ISC said it found the bug during internal testing, and credited Dave Aitel of OpenAI with independently discovering and reporting it. ISC sent early notification to its support customers on October 14 and published the advisory on October 21.
Which BIND versions should be updated?
Operators who build BIND from source should move to 9.20.30 on the stable branch or 9.21.27 on the development branch. JPRS advised anyone using distribution packages to follow their vendor’s updates and apply them as soon as they are available.
Debian has already shipped the fix for Debian 13 “trixie” in bind9 1:9.20.30-1~deb13u1, released under advisory DSA-6576-1 , which also covers the three other BIND vulnerabilities patched this month.
BIND 9.18 users will not get a patch. That branch reached end of life in June with version 9.18.50. ISC does not ship security fixes for unsupported branches, so the only remedy is migrating to 9.20.
The same release fixes three other high-severity denial-of-service bugs, each rated 7.5. CVE-2026-19630 lets crafted inbound messages with excessive name compression make named burn CPU and memory, which can starve busy resolvers. CVE-2026-96888 crashes resolvers that combine a redirect zone with strict QNAME minimisation. CVE-2026-97313 causes named to exit on recursive servers that hold conflicting response policy zone (RPZ) settings. ISC credited researcher Vitaly Simonovich with the last two.
Why is BIND getting so many security updates?
This is ISC’s fourth consecutive monthly BIND security release. In May, the organisation warned that large language models were making flaws in open-source code much easier to find. It said it was triaging vulnerability reports at a rate that “exceeds 10X the historic levels.”
ISC responded by putting security fixes in every monthly maintenance release and delaying the stable branch, BIND 9.22, to at least the end of 2026. The September release alone fixed 14 vulnerabilities. ISC has said it hopes to return to quarterly releases in the first quarter of 2027.
Join the conversation. Ask questions, solutions, and help others.
Be the first to start the discussion!
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
