ISC BIND 9: Memory corruption in named via replayed GSS-TSIG messages

Summary

ISC BIND 9 contains a flaw in the GSS-TSIG handling of the DNS server named that leads to memory corruption. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution, although a working exploit is not confirmed.

Affected

• ISC BIND 9 9.11.0 to 9.18.50
• ISC BIND 9 9.20.0 to 9.20.29
• ISC BIND 9 9.21.0 to 9.21.26
• ISC BIND 9 9.11.3-S1 to 9.18.50-S1
• ISC BIND 9 9.20.9-S1 to 9.20.29-S1
• Default configuration is not affected; GSS-TSIG must be enabled.

Fixed in

• BIND 9.20.30
• BIND 9.21.27
• BIND 9.20.30-S1
• Upgrade to the patched release closest to your current branch. Fixed versions for 9.18 and older are unknown; check the ISC vulnerability matrix.

Workaround

• ISC lists no known workarounds.
• Red Hat suggests removing the GSS-TSIG directives (tkey-gssapi-keytab, tkey-gssapi-credential) if Kerberos-authenticated dynamic DNS is not needed, then restarting named. This breaks Kerberos-based dynamic updates such as AD or IdM enrollment.
• Restrict network access to the DNS service with firewall rules. These measures reduce exposure but do not replace patching.

Exploitation

• ISC is not aware of any active exploits.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof of concept was found in the sources reviewed.

Our recommendation

• Check whether named uses GSS-TSIG (search named.conf for tkey-gssapi directives).
• If GSS-TSIG is used, patch to 9.20.30, 9.21.27 or 9.20.30-S1 promptly.
• If you run 9.18 or older, plan a migration to 9.20 now.
• If GSS-TSIG is not used, the risk is low, but apply the release in your regular maintenance window; it also fixes three DoS issues.
• Restrict DNS servers exposed to untrusted networks and monitor for crashes of named.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Ibonok/CVE-2026-94300

Research sources

• ISC BIND 9.20.30 download page downloads.isc.org
• ISC BIND 9.21.27 download page downloads.isc.org
• ISC advisory CVE-2026-94300 kb.isc.org
• ISC vulnerability matrix kb.isc.org
• BIND 9.20.30 release notes bind9.readthedocs.io
• Red Hat CVE page CVE-2026-94300 access.redhat.com
• Belgian CCB advisory ccb.belgium.be
• Canadian Cyber Centre advisory AV26-1072 www.cyber.gc.ca

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:11.