ISC BIND 9: four high-severity flaws fixed in 9.20.30 and 9.21.27, including CVE-2026-94300 (CVSS 8.1), where replayed GSS-TSIG-signed UDP messages can corrupt memory in named and may allow remote code execution; three resolver denial-of-service bugs (CVSS 7.5)
ISC published four BIND 9 security advisories on 21 October 2026, all rated High and remotely exploitable, after early notification to its support customers on 14 October. CVE-2026-94300 (CVSS 8.1, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): according to ISC, replaying GSS-TSIG-signed UDP messages can corrupt memory in named; an attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid, and by also sending crafted queries to a zone the attacker controls may potentially achieve remote code execution. ISC says it found the flaw in internal testing and thanks Dave Aitel of OpenAI, who independently found and reported it. CVE-2026-19630 (CVSS 7.5): ISC says inbound DNS messages with a particular structure trigger extra processing with no limit in a BIND resolver, so a message with a maliciously large number of them can exhaust CPU and memory. CVE-2026-96888 (CVSS 7.5): a resolver configured with both a 'redirect' zone and 'qname-minimization strict' may abort with an assertion failure. CVE-2026-97313 (CVSS 7.5): a recursive server with at least two RPZ zones, one with the default 'recursive-only yes' and one with 'recursive-only no', may exit with an assertion failure when a recursion-desired query is followed by a non-recursive one; ISC credits Vitaly Simonovich for the last two. ISC lists affected versions as 9.11.0 to 9.18.50 (9.16.0 onwards for CVE-2026-96888 and CVE-2026-97313), 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26, plus the Supported Preview Edition from 9.11.3-S1; fixes are 9.20.30, 9.21.27 and 9.20.30-S1. ISC says there are no workarounds and it is not aware of active exploits. ISC's download page lists 9.18.50 as end of life and 9.20.30 as the current stable extended-support release, and no 9.18 fix is listed. Source: ISC advisories CVE-2026-94300, CVE-2026-19630, CVE-2026-96888 and CVE-2026-97313 (21 Oct 2026).
- Product
- ISC BIND 9 (named authoritative and recursive DNS server)
- Versions
- Affected (ISC): 9.11.0–9.18.50, 9.20.0–9.20.29, 9.21.0–9.21.26 (CVE-2026-96888 and CVE-2026-97313 from 9.16.0); Supported Preview Edition 9.11.3-S1–9.18.50-S1 and 9.20.9-S1–9.20.29-S1. Fixed: 9.20.30, 9.21.27, 9.20.30-S1. 9.18 is end of life (no fix listed).
- CVSS
- (CVE-2026-94300); 7.5 (CVE-2026-19630, CVE-2026-96888, CVE-2026-97313)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Exploited in Australia?
- unknown
- Patch to
- Upgrade BIND to 9.20.30 or 9.21.27 (Supported Preview Edition: 9.20.30-S1); ISC lists no workarounds. Servers still on 9.18 or older are affected and 9.18 is end of life, so move them to 9.20.30. Prioritise servers that accept GSS-TSIG-signed updates or queries (typically Active Directory-integrated zones) and recursive resolvers using redirect zones with qname-minimization strict, or mixed recursive-only RPZ zones. Distribution users: take your vendor's patched bind9 package when it ships.
Primary: ISC — CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory (21 Oct 2026) · Vendor: ISC — BIND 9 Security Vulnerability Matrix · CVE: CVE-2026-94300, CVE-2026-19630, CVE-2026-96888, CVE-2026-97313 · ISC — CVE-2026-19630: amplified resource exhaustion in the BIND resolver (21 Oct 2026) · ISC — CVE-2026-96888: redirect zone with qname-minimization strict assertion (21 Oct 2026) · ISC — CVE-2026-97313: mixed recursive-only RPZ zones assertion (21 Oct 2026) · ISC — software downloads (9.20.30 current stable ESV; 9.18.50 end of life)