Zero Radar
← feed
HighVulnerabilityCVE-2026-94300updated 27 Oct 2026, 23:12 UTC

BIND DNS server: replayed signed messages can corrupt memory

A flaw in the BIND DNS server can be triggered by reusing a captured, signed network message, which can crash the server or corrupt its memory. In some cases an attacker may be able to run their own code on it.

Official, 5 sources
SeverityHighCVSS 8.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 5 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker captures trafficObtains a previously signed UDP message
  2. 2Replays signed messageSent while the TSIG key is still valid
  3. 3named corrupts memoryConcurrent GSS-TSIG processing breaks state
  4. 4Crafted zone queriesAttacker-controlled zone used to steer the bug
  5. ResultPossible remote code execution on DNS server

What happened

Replaying GSS-TSIG signed UDP messages while the negotiated TSIG key is still valid can cause memory corruption in named, BIND's DNS server process. Crafted queries to an attacker-controlled zone may potentially lead to remote code execution.

Why it is dangerous: A successful attack could take down DNS resolution for an organization or give an attacker control of the DNS server, which sits at the center of network name lookups. Organizations running affected BIND versions with GSS-TSIG enabled are at risk.

Are you affected?

You are affected if you run BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, or 9.20.9-S1 through 9.20.29-S1.

BIND 9.11.0–9.18.50; 9.20.0–9.20.29; 9.21.0–9.21.26; 9.11.3-S1–9.18.50-S1; 9.20.9-S1–9.20.29-S1

What to do

  1. Check whether your BIND version falls in the affected ranges above
  2. Install the security update from your vendor or the ISC release that fixes this issue, as listed in the Debian DSA-6576-1 and ISC advisories
  3. Restrict who can send GSS-TSIG signed traffic to your DNS servers if you cannot patch immediately
  4. Monitor named logs for crashes or unusual TSIG activity

Timeline

  1. 21 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 21 Oct 2026, 13:21 UTC
    Reported by NVD · NVD
  3. 22 Oct 2026, 16:49 UTC
    Reported by r/netsec · r/netsec
  4. 25 Oct 2026, 19:06 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 26 Oct 2026, 07:22 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  6. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  7. 26 Oct 2026, 12:29 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  8. 26 Oct 2026, 12:34 UTC
    Debian DSA reported on it · Debian DSA
  9. 27 Oct 2026, 12:17 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  10. 27 Oct 2026, 22:52 UTC
    Severity raised to high

Sources 8 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-94300 · GHSA-3g58-6x5w-h3fm · ZR-77cdde93 · ZR-bfbfeaa3 · ZR-42b3f02f
CVSS
8.1 / 10
EPSS
1.0% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 23:12 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

BIND DNS server: replayed signed messages can corrupt memory · Zero Radar