ISC Patches Four High-Severity BIND 9 Flaws, Including GSS-TSIG Memory Corruption
Do Son 
TL;DR
ISC disclosed four high-severity BIND 9 vulnerabilities on October 21, 2026. One, CVE-2026-94300, can corrupt memory and may allow remote code execution. The other three can crash DNS resolvers or exhaust their resources, causing a denial of service.
- Product: ISC BIND 9
- Vulnerabilities: 4 flaws (CVE-2026-94300, CVE-2026-19630, CVE-2026-97313, CVE-2026-96888)
- Highest severity: 8.1 (High · CVSSv3)
- Worst impact: Concurrent GSS-TSIG messages corrupt memory
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-94300 | 8.1 | CWE-362 | Not exploited |
| CVE-2026-19630 | 7.5 | CWE-407 | Not exploited |
| CVE-2026-97313 | 7.5 | CWE-617 | Not exploited |
| CVE-2026-96888 | 7.5 | CWE-476 | Not exploited |
Why It Matters
BIND is one of the most widely used DNS servers on the internet. When a resolver goes down, users behind it lose name lookups, and most online services stop working for them. In addition, ISC lists no workarounds for any of the four flaws.
Three of the bugs lead to denial of service, either by crashing named or by draining CPU and memory. For ISPs and enterprises running shared resolvers, a single crash can cut off name resolution for every user behind it.
How the Attacks Work
GSS-TSIG memory corruption (CVSS 8.1)
According to the CVE-2026-94300 advisory, “replaying GSS-TSIG signed UDP messages can result in memory corruption in named.” An attacker must first capture a signed message. With crafted queries to a zone they control, they “may potentially achieve remote code execution.” OpenAI’s Dave Aitel reported the flaw independently.
Resource exhaustion (CVSS 7.5)
The CVE-2026-19630 advisory warns that a malicious DNS message “will cause BIND to consume disproportionate amounts of CPU time and memory.” ISC found this one in internal testing.
Configuration-dependent crashes (CVSS 7.5)
- CVE-2026-97313: a recursive server with two RPZ zones using different “recursive-only” settings may exit on certain query patterns.
- CVE-2026-96888: a resolver with both a redirect zone and strict QNAME minimization may abort with an assertion failure.
Vitaly Simonovich reported both crash bugs.
Exploitation status
For all four BIND 9 vulnerabilities, ISC says it is “not aware of any active exploits.” No public proof-of-concept has been confirmed.
Affected Versions
- BIND 9.11.0 or 9.16.0 through 9.18.50, depending on the flaw
- BIND 9.20.0 through 9.20.29
- BIND 9.21.0 through 9.21.26
- Matching BIND Supported Preview Edition (-S1) releases
Patch and Mitigation Steps
- Upgrade to BIND 9.20.30 or 9.21.27, or 9.20.30-S1 for Preview Edition users.
- Plan a move off BIND 9.18, which has no fixed release listed.
- Review RPZ and redirect zone settings on resolvers.
Since no workarounds exist, upgrading is the only way to close these BIND 9 vulnerabilities.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
