Live › vulnerability › CVE-2026-94300
Go to dashboardReplaying a captured GSS-TSIG signed UDP message to BIND's named while the TSIG key is valid corrupts memory. Combined with crafted queries to an attacker-controlled zone, this may allow remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only BIND servers running an affected version that accept GSS-TSIG signed dynamic updates or queries are exposed; the sources tie the risk to a negotiated TSIG key still being valid. Servers on other BIND versions, or without GSS-TSIG configured, can likely skip it.
No product ranges from the sources yet.
named -V or named -v and compare the version against the affected ranges: 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.29-S1.tkey-gssapi-keytab or tkey-gssapi-credential) to see whether the feature is in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@_r_netsec · X1 likes · 1 reposts2026-10-22 17:03“CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory https://t.co/0PiMKDsvKD”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
This page as .md · .json · in your agent: get_signal("CVE-2026-94300")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.