CVE-2026-94300 Concurrent GSS-TSIG messages corrupt memory
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-94300?
CVE-2026-94300 is a high-severity vulnerability in ISC BIND 9, published on 21 Oct 2026.
Official description
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Which versions are affected by CVE-2026-94300?
How do I fix CVE-2026-94300?
Upgrade to a fixed version.
Is CVE-2026-94300 being exploited?
There is no known exploitation of CVE-2026-94300 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2026-94300, AZL-111509, BELL-CVE-2026-94300, DEBIAN-CVE-2026-94300, ECHO-55e3-067e-e810, GHSA-3g58-6x5w-h3fm and 2 more.