CVE-2026-94300

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://downloads.isc.org/isc/bind9/9.20.30
https://downloads.isc.org/isc/bind9/9.21.27
https://kb.isc.org/docs/cve-2026-94300

Configurations

No configuration.

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Reproducir mensajes UDP firmados con GSS?TSIG puede provocar corrupción de memoria en “named”. Un atacante que pueda capturar un mensaje UDP previamente firmado puede reproducirlo mientras la clave TSIG negociada sigue siendo válida. Al enviar también consultas manipuladas a una zona que controla el atacante, este podría potencialmente lograr ejecución remota de código.\n\nEste problema afecta a BIND?9 en las versiones desde 9.11.0 hasta 9.18.50 incluida, desde 9.20.0 hasta 9.20.29 incluida, desde 9.21.0 hasta 9.21.26 incluida, desde 9.11.3?S1 hasta 9.18.50?S1 incluida, y desde 9.20.9?S1 hasta 9.20.29?S1 incluida.

21 Oct 2026, 13:21

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 13:21

Updated : 2026-10-26 21:10

NVD link : CVE-2026-94300

Mitre link : CVE-2026-94300

CVE.ORG link : CVE-2026-94300

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-415

Double Free

{"id": "CVE-2026-94300", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94300", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-21T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.11.0", "versionType": "custom", "lessThanOrEqual": "9.18.50"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.29"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.26"}, {"status": "affected", "version": "9.11.3-S1", "versionType": "custom", "lessThanOrEqual": "9.18.50-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.29-S1"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-21T13:21:08.670", "references": [{"url": "https://downloads.isc.org/isc/bind9/9.20.30", "source": "security-officer@isc.org"}, {"url": "https://downloads.isc.org/isc/bind9/9.21.27", "source": "security-officer@isc.org"}, {"url": "https://kb.isc.org/docs/cve-2026-94300", "source": "security-officer@isc.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-362"}, {"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "Replaying GSS-TSIG signed UDP messages can result in memory corruption in \"`named`\". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1."}, {"lang": "es", "value": "Reproducir mensajes UDP firmados con GSS?TSIG puede provocar corrupci\u00f3n de memoria en \u201cnamed\u201d. Un atacante que pueda capturar un mensaje UDP previamente firmado puede reproducirlo mientras la clave TSIG negociada sigue siendo v\u00e1lida. Al enviar tambi\u00e9n consultas manipuladas a una zona que controla el atacante, este podr\u00eda potencialmente lograr ejecuci\u00f3n remota de c\u00f3digo.\\n\\nEste problema afecta a BIND?9 en las versiones desde 9.11.0 hasta 9.18.50 incluida, desde 9.20.0 hasta 9.20.29 incluida, desde 9.21.0 hasta 9.21.26 incluida, desde 9.11.3?S1 hasta 9.18.50?S1 incluida, y desde 9.20.9?S1 hasta 9.20.29?S1 incluida."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-officer@isc.org"}