{"id":"CVE-2026-94300","title":"Concurrent GSS-TSIG messages corrupt memory","summary":"Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-415","CWE-362"],"vendor":"ISC","product":"BIND 9","affected":["bind_9 >= 9.11.0 <= 9.18.50","bind_9 >= 9.20.0 <= 9.20.29","bind_9 >= 9.21.0 <= 9.21.26","bind_9 >= 9.11.3-S1 <= 9.18.50-S1","bind_9 >= 9.20.9-S1 <= 9.20.29-S1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-21T15:26:09.882834Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T17:19:14.274Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-94300","references":[{"url":"https://kb.isc.org/docs/cve-2026-94300","label":"CVE-2026-94300"},{"url":"https://downloads.isc.org/isc/bind9/9.20.30"},{"url":"https://downloads.isc.org/isc/bind9/9.21.27"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T12:48:53.583Z","slug":"CVE-2026-94300","body":"## Overview\n\nReplaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\".  An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.\n\n## Affected\n\n- `bind_9 >= 9.11.0 <= 9.18.50`\n- `bind_9 >= 9.20.0 <= 9.20.29`\n- `bind_9 >= 9.21.0 <= 9.21.26`\n- `bind_9 >= 9.11.3-S1 <= 9.18.50-S1`\n- `bind_9 >= 9.20.9-S1 <= 9.20.29-S1`\n\n## Remediation\n\nUpgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.\n\n### Workarounds\n\nNo workarounds known.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}