Servers, proxies and network services

ISC BIND 9: CVE-2026-94300 GSS-TSIG memory corruption

BIND check

Replaying a GSS-TSIG signed UDP message can corrupt memory in named, the BIND 9 name server. ISC says that, combined with crafted queries to a zone the attacker controls, it can lead to remote code execution, and at the least it can crash named. The attack is complex: the attacker must capture a signed message and replay it while the key is still valid.

What decides your exposure. The vulnerable code is in every build, but the path needs GSS-TSIG, which is used for secure dynamic updates against Kerberos or Active Directory. One analysis says builds with no GSS-TSIG configured do not reach it. ISC's advisory text does not spell out which configuration is required, so the script reports whether GSS-TSIG is configured as a hint, never as proof of safety, and says to update either way.

Quick start

1. Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.

   # BASE from GitHub:   https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main
   # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main
   # curl -fLO "$BASE/bind/bind-check.sh"
   curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/bind/bind-check.sh
   

2. Read it before running it, then make it executable.

   less bind-check.sh
   chmod +x bind-check.sh
   

3. Check this host. It finds named on PATH, in the usual locations and from running processes, and reads the configuration file the running process was started with.

   ./bind-check.sh check
   ./bind-check.sh check /opt/bind9/sbin/named
   

Commands

Environment: NAMED_CONF (space separated files) replaces configuration discovery.

Exit codes: 0 nothing exposed, 1 an affected version is exposed or its configuration could not be read, 2 bad arguments.

How to read the result

• Affected version and GSS-TSIG configured: exposed. Upgrade.
• Affected version, no GSS-TSIG setting found: exit 0 with a warning that you should update anyway. A text search can miss a setting generated elsewhere.
• End-of-life branch (9.18 and older, or the 9.19 development line): always reported as affected with no upstream fix. If your distribution supports it, watch its security tracker. The script reads the package changelog for a mention of the CVE and treats a mention as a likely backport. At the time of writing, Debian 13 had shipped the fix in bind9 1:9.20.30-1~deb13u1, while the 9.18 packages were still shown as vulnerable.
• Config unreadable: the script cannot tell, so it treats the host as exposed.
• Preview Edition (-S1) and distribution suffixes such as 9.20.30-1~deb13u1 or 9.18.39-0ubuntu0.24.04.8-Ubuntu are read correctly.

Fixing it

Upgrade to 9.20.30 or 9.21.27, or to a distribution build that carries the fix, then restart named. ISC lists no workaround. If you do not use GSS-TSIG, removing those settings is our suggestion rather than ISC's, and it does not replace the update.

Sources

• ISC advisory CVE-2026-94300
• BIND 9.20.30 download

Before you run it

• The fix. Update to 9.20.30 or 9.21.27 (9.20.30-S1 for the Preview Edition). ISC lists no workaround. The 9.18 branch and older are end of life and get no upstream fix. A distribution that still supports 9.18 may backport it, which the script looks for.
• GSS-TSIG is a hint, not a verdict. The vulnerable path needs GSS-TSIG (used for secure dynamic updates against Kerberos or Active Directory), but ISC does not spell out which configuration is required. The script reports whether GSS-TSIG is configured and tells you to update either way.
• It never reloads named. It finds named in PATH, the usual locations and running processes, reads the version from named -v and reads named.conf and its include files.
• Other flaws ride along. The same releases fix three denial of service flaws that only the update fixes.
• It also checks running docker and podman containers, unless you name a directory or set SCAN_CONTAINERS=0. A read-only probe inside each running docker and podman container captures the output of named -v and named -V and the configuration files (with every secret "..." value redacted inside the container before it is copied) into a private temporary directory. The script then runs once per container, in isolation, against that copy, so one container's configuration never changes another's result. include paths are resolved inside the container's copy, not on the host. The copies are removed on exit. A path shown as .../docker_NAME/... is inside the container NAME. It is skipped when you name a binary or directory yourself.

Red Hat advisories

Red Hat's advisory list (security advisories released 2026-04-01 to 2026-11-03) names the CVEs below. A Red Hat build is judged by its RPM release, not by the upstream version number, because Red Hat backports fixes: the advisory names the release that fixes it. A CVE with no advisory in the list has none for that period, which is not the same as not affected. The current state is on Red Hat's CVE database.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg