CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory
Concurrent GSS-TSIG messages corrupt memory
Other sources
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
— MITRE
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.18.39-0ubuntu0.22.04.8 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.18.39-0ubuntu0.24.04.9 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.20.24-1ubuntu3.1 - Upgrade
Upgrade
ubuntu/bind9to a version that resolves this vulnerability.Fixed in 1:9.20.24-1ubuntu0.5 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.21.27 - Upgrade
Upgrade
BIND 9to a version that resolves this vulnerability.Fixed in 9.20.30-S1
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review BIND 9 servers running named in the listed affected version ranges, particularly where GSS-TSIG-signed UDP traffic is used. The affected ranges include 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
What capabilities does an attacker need?
The attacker must be able to capture a previously signed GSS-TSIG UDP message and replay it while its negotiated TSIG key remains valid. They must also be able to send crafted queries to a zone they control; no authenticated privileges or user interaction are indicated by the supplied metrics.
Which updated releases are identified in the supplied data?
The supplied references identify BIND 9.20.30 and 9.21.27, which are outside the affected 9.20 and 9.21 ranges. The data does not identify corresponding fixed releases for the affected 9.11 or 9.18 branches.