BIND 9.20.30 fixes four High flaws, one may allow remote code execution

BIND 9.20.30 fixes four High flaws, one may allow remote code execution

21 October 2026: ISC has released BIND 9.20.30 and 9.21.27 to fix four High severity vulnerabilities in named, the most serious of which, CVE-2026-94300 (CVSS 8.1), lets an attacker replay signed GSS-TSIG messages to corrupt memory and possibly run code. The other three let a remote attacker crash or exhaust a resolver. ISC knows of no active exploits and offers no workarounds.

Not yet independently verified. ISC's pages list no fixed release on the 9.18 branch; we have not found whether one is planned. We will update this when it can be confirmed, and remove this note.

Fixed versions

• BIND 9.20: 9.20.30
• BIND 9.21 (development): 9.21.27
• Supported Preview Edition: 9.20.30-S1

Every flaw also reaches back into the 9.18 line and earlier, but ISC lists no fixed 9.18 release, so servers still on 9.18 need to move to 9.20.30.

The GSS-TSIG flaw

GSS-TSIG is the Kerberos-based signing that Active Directory environments use for secure dynamic DNS updates, so it is most common where BIND serves zones alongside Windows domains. An attacker who has captured one GSS-TSIG signed UDP message can replay it while the key is still valid, and concurrent replays corrupt memory in named, crashing it. ISC adds: "By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution." The flaw was found in ISC's own testing and independently reported by Dave Aitel of OpenAI. Affected: 9.11.0 to 9.18.50, 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26.

Three ways to take a resolver down

CVE	CVSS	What happens
CVE-2026-19630	7.5	Certain inbound messages trigger unlimited extra processing, so many of them exhaust CPU and memory
CVE-2026-96888	7.5	named can stop with an assertion failure when a redirect zone is used with qname-minimization strict
CVE-2026-97313	7.5	With recursion allowed and two RPZ zones, one recursive-only yes and one recursive-only no, a recursive query followed by a non-recursive one crashes named

The last two need specific configurations, so an administrator can check whether they apply by reading named.conf. The resource exhaustion flaw needs no special setup and affects resolvers broadly; ISC found it in its own testing.

ISC gave its support customers early notice on 14 October and published on 21 October. Distribution packages follow on each vendor's schedule, so servers on a long-term-support Linux release depend on that vendor's backport.

Sources

• ISC: CVE-2026-94300, Concurrent GSS-TSIG messages corrupt memory, 21 October 2026
• ISC: CVE-2026-19630, Amplified resource exhaustion in inbound message processing, 21 October 2026
• ISC: CVE-2026-96888, 21 October 2026
• ISC: CVE-2026-97313, 21 October 2026
• Canadian Centre for Cyber Security: ISC BIND security advisory (AV26-1072), 21 October 2026