{"id":"CVE-2026-94300","kind":"vulnerability","aliases":["CVE-2026-94300"],"related":[],"title":"BIND named: replayed GSS-TSIG UDP messages corrupt memory, possibly allowing code execution","description":"Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.","summary":"Replaying a captured GSS-TSIG signed UDP message to BIND's named while the TSIG key is valid corrupts memory. Combined with crafted queries to an attacker-controlled zone, this may allow remote code execution.","severity":"high","cvss":8.1,"epss":0.00734,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bind","dns","linux","runtime","self-hosted"],"not_affected_if":["default-config","non-affected-version"],"how_to_check":"- Run `named -V` or `named -v` and compare the version against the affected ranges: 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.29-S1.\n- Check named.conf for GSS-TSIG configuration (`tkey-gssapi-keytab` or `tkey-gssapi-credential`) to see whether the feature is in use.","fix":"- Upgrade BIND to a fixed release that is newer than the affected ranges above (the sources do not list the exact fixed version: unknown).\n- Until patched, disable GSS-TSIG if it is not needed (version of the workaround: unknown).","status":"open","published_at":"2026-10-21T13:21:08+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:05:54+00:00","updated_at":"2026-10-25T03:05:54+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:05:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade BIND to a fixed release that is newer than the affected ranges above (the sources do not list the exact fixed version: unknown).\n- Until patched, disable GSS-TSIG if it is not needed (version of the workaround: unknown).","reach":"network","title":"BIND named: replayed GSS-TSIG UDP messages corrupt memory, possibly allowing code execution","impact":"high","summary":"Replaying a captured GSS-TSIG signed UDP message to BIND's named while the TSIG key is valid corrupts memory. Combined with crafted queries to an attacker-controlled zone, this may allow remote code execution.","category":"runtime","nicknames":[],"who_cares":["bind","dns","self-hosted","linux"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote code execution on the DNS server if the attack chain succeeds","analyst_note":"Find the fixed BIND release numbers and the GSS-TSIG configuration that enables the flaw, from the ISC advisory for CVE-2026-94300 (sources only give NVD and EPSS).","how_to_check":"- Run `named -V` or `named -v` and compare the version against the affected ranges: 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.29-S1.\n- Check named.conf for GSS-TSIG configuration (`tkey-gssapi-keytab` or `tkey-gssapi-credential`) to see whether the feature is in use.","needs_analyst":true,"not_affected_if":["default-config","non-affected-version"],"who_is_affected":"Only BIND servers running an affected version that accept GSS-TSIG signed dynamic updates or queries are exposed; the sources tie the risk to a negotiated TSIG key still being valid. Servers on other BIND versions, or without GSS-TSIG configured, can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":3518,"output_tokens":738,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-94300':17A,20A '9':123C '9.11.0':125C '9.11.3':134C '9.18.50':127C,137C '9.20.0':128C '9.20.29':130C,143C '9.20.9':140C '9.21.0':131C '9.21.26':133C 'achiev':115C 'affect':121C 'allow':12A,61B 'also':101C 'attack':56B,80C,109C,112C 'attacker-control':55B 'bind':1A,21B,38B,122C 'captur':30B,83C 'code':13A,63B,117C 'combin':49B 'control':57B,110C 'corrupt':9A,47B,76C 'craft':51B,103C 'cve':15A,18A 'dns':22B 'execut':14A,64B,118C 'gss':5A,32B,67C 'gss-tsig':4A,31B,66C 'host':27B 'issu':120C 'key':44B,96C 'linux':23B 'may':60B,113C 'memori':10A,48B,75C 'messag':8A,36B,71C,88C 'name':2A,40B,78C 'negoti':94C 'possibl':11A 'potenti':114C 'previous':85C 'queri':52B,104C 'remot':62B,116C 'replay':3A,28B,65C,90C 'result':73C 'runtim':24B 's1':135C,138C,141C,144C 'self':26B 'self-host':25B 'send':102C 'sign':34B,69C,86C 'still':98C 'tsig':6A,33B,43B,68C,95C 'udp':7A,35B,70C,87C 'valid':46B,99C 'version':124C 'zone':58B,107C","nicknames":[],"mitigations":[],"who_affected":"Only BIND servers running an affected version that accept GSS-TSIG signed dynamic updates or queries are exposed; the sources tie the risk to a negotiated TSIG key still being valid. Servers on other BIND versions, or without GSS-TSIG configured, can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:21:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-officer@isc.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94300","severity":null,"published_at":"2026-10-21T13:21:08+00:00","modified_at":"2026-10-22T23:20:34+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94300","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94300","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":379,"url":"https://x.com/_r_netsec/status/2113315282194440566","title":"@_r_netsec: CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory https://t.co/0PiMKDs","kind":"post","source":"x","text":"CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory https://t.co/0PiMKDsvKD\n\nlikes 1 reposts 1","published_at":"2026-10-22T17:03:21+00:00","relation":"discussion","confidence":null,"note":"@_r_netsec"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}