CVE-2026-94300: BIND 9 GSS-TSIG RCE Vulnerability

CVE-2026-94300 Overview

CVE-2026-94300 is a memory corruption vulnerability in ISC BIND 9's named daemon triggered by replaying GSS-TSIG signed UDP messages. An attacker who captures a previously signed UDP message can replay it while the negotiated Transaction Signature (TSIG) key remains valid. By combining the replay with crafted queries to an attacker-controlled zone, the attacker may achieve remote code execution against the DNS server. The flaw is tracked under [CWE-362] as a race condition and affects multiple release branches of BIND 9, including supported subscription (-S1) builds.

Critical Impact

Successful exploitation can corrupt memory in named and potentially lead to remote code execution on authoritative or recursive DNS infrastructure.

Affected Products

• BIND 9 versions 9.11.0 through 9.18.50
• BIND 9 versions 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26
• BIND 9 Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1

Discovery Timeline

• 2026-10-21 - CVE-2026-94300 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-94300

Vulnerability Analysis

The vulnerability lives in named's handling of GSS-TSIG signed UDP messages. GSS-TSIG is a Generic Security Services (GSS) based mechanism for authenticating DNS transactions, typically used to secure dynamic updates in environments integrated with Kerberos. When a signed UDP message is replayed while the negotiated TSIG key context is still valid, named fails to safely reconcile message state, producing memory corruption inside the daemon.

The issue is classified under [CWE-362] (concurrent execution using shared resource with improper synchronization). The high attack complexity reflects the preconditions: the attacker must observe a legitimate signed message, replay it within the key's validity window, and simultaneously drive queries toward a zone they control to influence memory layout.

Root Cause

The root cause is improper handling of state tied to the GSS-TSIG key context when the same signed UDP payload is processed more than once. The replayed message interacts with structures that assume single-use processing, enabling an attacker-influenced memory corruption condition.

Attack Vector

The attack is network-based and requires no authentication or user interaction. The adversary must capture a GSS-TSIG signed UDP message in transit, replay it to the target named instance before the TSIG key expires, and issue crafted DNS queries to a zone under their control. The combined inputs steer the corruption toward code execution. See the ISC CVE-2026-94300 Documentation for vendor technical details.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no sanitized proof-of-concept has been released by the vendor.

Detection Methods for CVE-2026-94300

Indicators of Compromise

• Duplicate GSS-TSIG signed UDP messages with identical signatures arriving at authoritative or recursive BIND resolvers within a short time window.
• Unexpected named process crashes, restarts, or assertion failures logged by systemd, syslog, or the BIND named.log channel.
• Outbound DNS queries from named toward attacker-controlled zones immediately following replayed signed messages.

Detection Strategies

• Enable BIND query logging and TSIG debug logging to surface repeated signatures and GSS-TSIG negotiation anomalies.
• Deploy network IDS signatures that flag replayed signed UDP DNS messages exhibiting identical TSIG MAC values from different timestamps or sources.
• Correlate named crash events with inbound GSS-TSIG traffic in SIEM to identify exploitation attempts.

Monitoring Recommendations

• Track BIND version inventory across authoritative and recursive servers and alert on unpatched builds listed in the affected ranges.
• Monitor Kerberos ticket issuance patterns tied to DNS service principals for abnormal replay-adjacent activity.
• Baseline UDP DNS message volumes per source and alert on bursts targeting dynamic update endpoints.

How to Mitigate CVE-2026-94300

Immediate Actions Required

• Upgrade to BIND 9.20.30 or BIND 9.21.27, or the corresponding -S1 subscription builds.
• Inventory all internet-exposed named instances and prioritize patching authoritative servers accepting dynamic updates signed with GSS-TSIG.
• Review DNS logs for recent duplicate signed UDP messages prior to patching.

Patch Information

ISC has released fixed versions. Operators should upgrade to BIND 9.20.30, 9.21.27, or the equivalent Supported Preview Edition builds. Refer to the ISC CVE-2026-94300 Documentation for the full fix matrix and backport details.

Workarounds

• Shorten the lifetime of negotiated GSS-TSIG keys so replayed messages fall outside the validity window faster.
• Restrict dynamic update sources using allow-update and update-policy ACLs to known internal addresses only.
• Terminate DNS over authenticated, encrypted transports where feasible to prevent passive capture of signed UDP messages.

# Configuration example: restrict dynamic updates to trusted sources
zone "example.com" {
    type master;
    file "zones/example.com.db";
    update-policy {
        grant DHCP-SERVER.EXAMPLE.COM ms-self * A AAAA;
    };
    allow-update { 10.0.0.0/24; };
};