CVE-2026-94300High· 8.1▾ TwilightReplaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
bind_9 >= 9.11.0 <= 9.18.50bind_9 >= 9.20.0 <= 9.20.29bind_9 >= 9.21.0 <= 9.21.26bind_9 >= 9.11.3-S1 <= 9.18.50-S1bind_9 >= 9.20.9-S1 <= 9.20.29-S1Upgrade to the patched release most closely related to your current version of BIND 9: 9.20.30, 9.21.27, or 9.20.30-S1.
No workarounds known.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97313High· 7.5Specific RPZ configurations and query patterns may result in an unexpected exit
CVE-2026-19630High· 7.5Amplified resource exhaustion in inbound message processing
CVE-2026-96888High· 7.5Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
CVE-2026-80274High· 7.5If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an un…
CVE-2026-76163High· 7.5If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. This issue affects BIND 9 ver…
CVE-2026-19666High· 7.5On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly. This issue affects BIND 9 versions 9.11.0 through 9.18.…