CVE-2026-94300

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94300", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "state": "PUBLISHED", "assignerShortName": "isc", "dateReserved": "2026-09-21T09:46:27.369Z", "datePublished": "2026-10-21T12:45:26.540Z", "dateUpdated": "2026-10-22T23:04:30.599Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-10-21T12:45:26.540Z"}, "title": "Concurrent GSS-TSIG messages corrupt memory", "datePublic": "2026-10-21T00:00:00.000Z", "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"version": "9.11.0", "lessThanOrEqual": "9.18.50", "status": "affected", "versionType": "custom"}, {"version": "9.20.0", "lessThanOrEqual": "9.20.29", "status": "affected", "versionType": "custom"}, {"version": "9.21.0", "lessThanOrEqual": "9.21.26", "status": "affected", "versionType": "custom"}, {"version": "9.11.3-S1", "lessThanOrEqual": "9.18.50-S1", "status": "affected", "versionType": "custom"}, {"version": "9.20.9-S1", "lessThanOrEqual": "9.20.29-S1", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.11.0", "versionEndIncluding": "9.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.0", "versionEndIncluding": "9.20.29"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.21.0", "versionEndIncluding": "9.21.26"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.11.3-S1", "versionEndIncluding": "9.18.50-S1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.20.9-S1", "versionEndIncluding": "9.20.29-S1"}]}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}, {"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)"}]}], "descriptions": [{"lang": "en", "value": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Memory corruption, leading to program abort and/or potential remote code execution."}]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1."}], "credits": [{"lang": "en", "value": "While this flaw was discovered in internal testing, ISC would like to thank Dave Aitel from OpenAI who independently discovered and responsibly reported the issue to ISC."}], "references": [{"url": "https://kb.isc.org/docs/cve-2026-94300", "name": "CVE-2026-94300", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.30", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.27", "tags": ["patch"]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-21T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-94300"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T23:04:30.599Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94300", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-21T15:26:09.882834Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-21T17:09:58.794Z"}}], "cna": {"title": "Concurrent GSS-TSIG messages corrupt memory", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "While this flaw was discovered in internal testing, ISC would like to thank Dave Aitel from OpenAI who independently discovered and responsibly reported the issue to ISC."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Memory corruption, leading to program abort and/or potential remote code execution."}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.29"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.26"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.29-S1"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "We are not aware of any active exploits."}], "solutions": [{"lang": "en", "value": "Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1."}], "datePublic": "2026-10-21T00:00:00.000Z", "references": [{"url": "https://kb.isc.org/docs/cve-2026-94300", "name": "CVE-2026-94300", "tags": ["vendor-advisory"]}, {"url": "https://downloads.isc.org/isc/bind9/9.20.30", "tags": ["patch"]}, {"url": "https://downloads.isc.org/isc/bind9/9.21.27", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "No workarounds known."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}, {"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.18.50", "versionStartIncluding": "9.11.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.20.29", "versionStartIncluding": "9.20.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.21.26", "versionStartIncluding": "9.21.0"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.18.50-S1", "versionStartIncluding": "9.11.3-S1"}, {"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "9.20.29-S1", "versionStartIncluding": "9.20.9-S1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "404fd4d2-a609-4245-b543-2c944a302a22", "shortName": "isc", "dateUpdated": "2026-10-21T12:45:26.540Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94300", "state": "PUBLISHED", "dateUpdated": "2026-10-21T17:19:14.274Z", "dateReserved": "2026-09-21T09:46:27.369Z", "assignerOrgId": "404fd4d2-a609-4245-b543-2c944a302a22", "datePublished": "2026-10-21T12:45:26.540Z", "assignerShortName": "isc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BIND 9", "vendor": "ISC", "versions": [{"lessThanOrEqual": "9.18.50", "status": "affected", "version": "9.11.0", "versionType": "custom"}, {"lessThanOrEqual": "9.20.29", "status": "affected", "version": "9.20.0", "versionType": "custom"}, {"lessThanOrEqual": "9.21.26", "status": "affected", "version": "9.21.0", "versionType": "custom"}, {"lessThanOrEqual": "9.18.50-S1", "status": "affected", "version": "9.11.3-S1", "versionType": "custom"}, {"lessThanOrEqual": "9.20.29-S1", "status": "affected", "version": "9.20.9-S1", "versionType": "custom"}]}], "source": "security-officer@isc.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1."}, {"lang": "es", "value": "Reproducir mensajes UDP firmados con GSS?TSIG puede provocar corrupci\u00f3n de memoria en \u201cnamed\u201d. Un atacante que pueda capturar un mensaje UDP previamente firmado puede reproducirlo mientras la clave TSIG negociada sigue siendo v\u00e1lida. Al enviar tambi\u00e9n consultas manipuladas a una zona que controla el atacante, este podr\u00eda potencialmente lograr ejecuci\u00f3n remota de c\u00f3digo.\\n\\nEste problema afecta a BIND?9 en las versiones desde 9.11.0 hasta 9.18.50 incluida, desde 9.20.0 hasta 9.20.29 incluida, desde 9.21.0 hasta 9.21.26 incluida, desde 9.11.3?S1 hasta 9.18.50?S1 incluida, y desde 9.20.9?S1 hasta 9.20.29?S1 incluida."}], "id": "CVE-2026-94300", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-officer@isc.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94300", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-21T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-10-21T13:21:08.670", "references": [{"source": "security-officer@isc.org", "url": "https://downloads.isc.org/isc/bind9/9.20.30"}, {"source": "security-officer@isc.org", "url": "https://downloads.isc.org/isc/bind9/9.21.27"}, {"source": "security-officer@isc.org", "url": "https://kb.isc.org/docs/cve-2026-94300"}], "sourceIdentifier": "security-officer@isc.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-415"}], "source": "security-officer@isc.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:87309", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "bind-main-9.20.30-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-21T00:00:00Z"}], "bugzilla": {"description": "bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay", "id": "2556407", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556407"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-366", "details": ["A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service."], "mitigation": {"lang": "en:us", "value": "Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls.\nTo disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service:\nsystemctl restart named\nIf operating named inside a chroot environment, execute:\nsystemctl restart named-chroot\nAlternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access.\nCaveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment.\nWarning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients."}, "name": "CVE-2026-94300", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "bind9.16", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "bind", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "bind9.18", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "dhcp", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94300\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94300\nhttps://kb.isc.org/docs/cve-2026-94300"], "statement": "Red Hat Product Security has rated this vulnerability as Important rather than Critical because, while remote unauthenticated code execution is possible, exploitation depends on capturing active cryptographic keys within their validity window and orchestrating complex concurrent requests. In standard Red Hat Enterprise Linux deployments, the BIND daemon does not enable GSS-TSIG by default, restricting risk primarily to servers integrated with Kerberos-based identity infrastructure like FreeIPA or Active Directory. Deployments that do not negotiate GSS-TSIG keys or that strictly limit dynamic DNS access to trusted networks remain unexposed to this attack vector.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.11.0,9.18.50]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.0,9.20.29]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.21.0,9.21.26]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.11.3-S1,9.18.50-S1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.9-S1,9.20.29-S1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "BIND 9", "source": "cna", "vendor": "ISC"}, "product": "bind", "vendor": "isc"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.11.0,9.18.50]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.0,9.20.29]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.21.0,9.21.26]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.11.3-S1,9.18.50-S1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.20.9-S1,9.20.29-S1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "BIND 9", "source": "cna", "vendor": "ISC"}, "product": "bind_9", "vendor": "isc"}], "created": "2026-10-21T19:15:16.266833+00:00", "updated": "2026-10-22T16:15:08.393527+00:00", "vendors": ["isc", "isc$PRODUCT$bind", "isc$PRODUCT$bind_9"]}