Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2026-94300 EUVD-2026-107254GHSA-3g58-6x5w-h3fm

Concurrent GSS-TSIG messages corrupt memory

Published Oct 21, 2026 · Updated Oct 22, 2026 · Assigned by isc

Vendor: ISC Product: BIND 9 Package: bind Package: bind Package: bind Package: bind-dev Package: bind-dnssec-root Package: bind-dnssec-tools Package: bind-doc Package: bind-libs Package: bind-plugins Package: bind-tools Package: bind9 Package: bind9 Package: bind9-libs Package: isc-dhcp Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Affected products

VendorProductAffectedFixed
ISC BIND 9 9.11.0 – ≤ 9.18.50, 9.20.0 – ≤ 9.20.29, 9.21.0 – ≤ 9.21.26, 9.11.3-S1 – ≤ 9.18.50-S1, 9.20.9-S1 – ≤ 9.20.29-S1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bind9 1:9.20.30-1 —
Debian 13 bind9 1:9.20.30-1~deb13u1 —
Debian 12 bind9 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 bind9 1:9.20.24-1ubuntu3.1 USN-8969-1
Ubuntu 26.04 LTS bind9 1:9.20.24-1ubuntu0.5 USN-8969-1
Ubuntu 26.04 LTS isc-dhcp No fix yet —
Ubuntu 24.04 LTS bind9 1:9.18.39-0ubuntu0.24.04.9 USN-8969-1
Ubuntu 24.04 LTS isc-dhcp No fix yet —
Ubuntu 22.04 LTS bind9 1:9.18.39-0ubuntu0.22.04.8 USN-8969-1
Ubuntu 22.04 LTS bind9-libs No fix yet —
Ubuntu 20.04 LTS bind9-libs No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS isc-dhcp No fix yet —
Ubuntu Pro 20.04 LTS bind9 No fix yet —
Ubuntu Pro 18.04 LTS bind9 No fix yet —

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 bind +7 32:9.18.33-15.el10_2.14 ALSA-2026:92419
AlmaLinux 9 bind +9 32:9.16.23-40.el9_8.13 ALSA-2026:93610
AlmaLinux 9 bind9.18 +6 32:9.18.29-14.el9_8.12 ALSA-2026:93072
AlmaLinux 8 bind +16 32:9.11.36-18.el8_10 ALSA-2026:93925
AlmaLinux 8 bind9.16 +8 32:9.16.23-0.22.el8_10.21 ALSA-2026:94011

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 bind 2:9.18.33-15.el10_2.14 RLSA-2026:92419
Rocky Linux 9 bind 2:9.16.23-40.el9_8.13 RLSA-2026:98497, RLSA-2026:93610
Rocky Linux 9 bind-doc +8 2:9.16.50-12.el9_9.1 RLSA-2026:98497
Rocky Linux 9 bind9.18 2:9.18.29-14.el9_8.12 RLSA-2026:98525, RLSA-2026:93072
Rocky Linux 9 bind9.18-doc +5 2:9.18.29-29.el9_9.1 RLSA-2026:98525
Rocky Linux 8 bind 2:9.11.36-18.el8_10 RLSA-2026:93925
Rocky Linux 8 bind9.16 2:9.16.23-0.22.el8_10.21 RLSA-2026:94011

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bind 9.20.30-1.1 openSUSE-SU-2026:12231-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 bind 9.20.30-r0 —
Alpine v3.23 bind 9.20.30-r0 —
Alpine v3.22 bind 9.20.30-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 bind +7 32:9.18.50-1.amzn2023.0.5 ALAS2023-2026-3312
Amazon Linux 2 bind +15 32:9.11.4-26.P2.amzn2.13.20 ALAS2-2026-4038

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 bind No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 bind +7 32:9.18.33-15.0.1.el10_2.14 ELSA-2026-92419
Oracle Linux 9 bind +9 32:9.16.23-40.0.1.el9_8.13 ELSA-2026-93610
Oracle Linux 9 bind9.18 +6 32:9.18.29-14.el9_8.12 ELSA-2026-93072
Oracle Linux 8 bind +16 32:9.11.36-18.el8_10 ELSA-2026-93925
Oracle Linux 8 bind9.16 +8 32:9.16.23-0.22.el8_10.21 ELSA-2026-94011

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling bind +7 No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Ibonok/CVE-2026-94300 ★ 0 · Oct 23, 2026

    CVE-2026-94300: This analysis and PoC were produced substantially with AI assistance ("AI patchwork"). Every code, diff and measurement claim should be verified against the cited sources before being…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 22

References