ISC BIND 9 · Disclosed

ISC fixes BIND memory corruption from concurrent GSS-TSIG messages

Oct 20, 2026 · 1 min read

ISC fixed CVE-2026-94300, memory corruption in BIND 9's named triggered by concurrent GSS-TSIG messages, the signatures used with Active Directory integrated DNS. Fixes cover the 9.20 and 9.21 lines, and no fixed build was listed for the 9.11 through 9.18 line. Update to 9.20.30 or 9.21.27, or 9.20.30-S1, and apply DSA-6576-1 on Debian trixie.

By HIFY Radar newsroom Updated 10/26/2026 01:17 PM Get this every day →← Back to the feed 3 sources

HighVulnerabilityDisclosedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

ISC fixed CVE-2026-94300, a high-severity flaw in the BIND 9 DNS server (named). By capturing and replaying signed messages, an attacker can corrupt server memory and, according to Debian and JPRS, potentially execute code remotely and stop the DNS service.

Why it matters

The flaw can interrupt company name resolution and compromise the DNS server, with risk of remote code execution. Installations on the legacy 9.11 through 9.18 branches will receive no ISC fix, and on Debian bookworm the listed versions remain vulnerable.

What to do

Upgrade immediately to BIND 9.20.30 or 9.21.27 (or 9.20.30-S1) and apply DSA-6576-1 on Debian trixie. Servers on 9.11 through 9.18 must migrate to a supported branch.

For the technical team

CVE: CVE-2026-94300
Affected: ISC BIND 9 (named) · BIND 9.11.0 through 9.18.50; 9.20.0 through 9.20.29; 9.21.0 through 9.21.26; Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1. Debian bookworm: 1:9.18.49-1~deb12u1 and 1:9.18.49-1~deb12u3 vulnerable; Debian trixie: 1:9.20.26-1~deb13u1 vulnerable.
Exploitation: No exploitation report, public PoC or KEV entry cited in the sources. ISC rates severity high; JPRS issued an urgent alert on 2026/10/22 recommending immediate upgrade.
Fix: BIND 9.20.30; 9.21.27; Supported Preview Edition 9.20.30-S1. Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); Debian unstable/forky/sid: 1:9.20.30-1. No fix for the 9.11 through 9.18 branches: ISC releases no security patches for unsupported series, per JPRS.
Vector: named (BIND 9). Replaying GSS-TSIG signed UDP messages (RFC 3645) corrupts memory in named while the negotiated TSIG key is still valid; combined with crafted queries to an attacker-controlled zone, remote code execution is potentially achievable (Debian description). JPRS states no temporary workaround exists.
More details: ISC lists the start date as 2026-10-21. The ISC advisory title is 'Concurrent GSS-TSIG messages corrupt memory'; the Debian description details replay of signed UDP messages while the TSIG key is valid. Debian DSA-6576-1 also fixes CVE-2026-19630, CVE-2026-96888 and CVE-2026-97313. JPRS points to bind-9.20.30.tar.xz on ftp.isc.org as the fixed release. Timeline: ISC and Debian publish partial fixes on 2026-10-26; JPRS issues urgent alert.