Incident summary

CVE-2026-94300 is a high-severity BIND 9 memory-corruption vulnerability. A replayed GSS-TSIG signed UDP message, combined with crafted queries to an attacker-controlled zone, can corrupt memory in named. ISC rates it High with CVSS 3.1 score 8.1 and says the outcome can include process abort or potential remote code execution.

The vendor published the advisory on October 21, 2026. No known active exploits were reported at that time.

Response scope

Begin with the binary and configuration that are actually running. The affected mainline ranges are 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26. The affected preview ranges are 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1.

Next, determine whether the service negotiates GSS-TSIG. Red Hat notes that this feature is not enabled by default in standard deployments. Search the effective configuration for GSS-TSIG key settings, including tkey-gssapi-keytab and tkey-gssapi-credential, and check included configuration files.

What the attacker needs

The exploit path requires a captured signed UDP message that can be replayed while its negotiated key is valid. The attacker must also control a DNS zone and direct crafted queries toward the service. The flaw is a thread race, so concurrency and timing contribute to the result.

There is no public indication that every BIND instance is immediately exploitable. The feature still requires an explicit configuration check, especially in Kerberos-heavy networks.

Service and business impact

An abort can take a resolver or authoritative server out of service. The scope of that failure depends on redundancy, cached answers, client timeouts, and how quickly supervision restarts the process. Potential remote code execution is a more severe outcome. It could expose DNS data or provide an attacker with the service account's access.

The advisory does not describe an observed campaign involving code execution. Response planning should distinguish a documented capability from evidence of compromise. Monitor DNS service stability and use the organization's normal evidence sources when judging anomalous events.

Internet exposure

ZoomEye returned 16,277,823 matches for app="BIND" and 0 for vul.cve="CVE-2026-94300" during this review. The selected Exposure is 16,277,823, but it reflects BIND product fingerprints rather than confirmed vulnerable hosts. It does not reveal whether a system uses GSS-TSIG, has the correct patch level, or remains reachable from an untrusted network.

Remediation checklist

  1. 1.

    Identify all BIND 9 services and their support branches.

  2. 2.

    Map configuration files that set GSS-TSIG options.

  3. 3.

    Upgrade to 9.20.30, 9.21.27, or 9.20.30-S1 as appropriate.

  4. 4.

    Restart and verify the running named binary and effective configuration.

  5. 5.

    If the patch cannot be applied promptly, assess Red Hat's option to remove unnecessary GSS-TSIG settings or restrict DNS access to trusted networks.

  6. 6.

    Confirm that any containment change does not break Kerberos-authenticated dynamic updates.

ISC lists no workaround. Red Hat's containment guidance is useful for reducing exposure, but it has operational consequences and does not install the code fix.

References