ISC BIND: Memory Corruption and Potential RCE via GSS-TSIG Replay, Plus Three Remote DoS Vulnerabilities

1. Overview

• Advisory Name: CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory
• Publisher: ISC
• Release Date: 2026-10-21
• Original Source: CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory
• Related Sources: ISC: CVE-2026-19630, ISC: CVE-2026-96888, ISC: CVE-2026-97313, JVN: Multiple vulnerabilities in ISC BIND (October 2026)
• Related Malware and Threat Groups: Unidentified
• Related CVEs: CVE-2026-94300, CVE-2026-19630, CVE-2026-96888, CVE-2026-97313
• Affected Products: ISC BIND 9
• Severity: High
• Severity Rationale: In addition to service disruption for DNS resolvers and authoritative server infrastructure, environments with GSS-TSIG enabled risk memory corruption and potential remote code execution (RCE). (Active exploitation has not been reported by ISC.)

2. Executive Summary

Four remote vulnerabilities have been published for ISC BIND 9. Notably, CVE-2026-94300 combines the replay of valid GSS-TSIG-signed UDP messages with queries directed at an attacker-controlled zone, which can lead from memory corruption to potential RCE.

3. Attack Flow

The following represent independent vulnerability attack paths and are not chained together sequentially in a single attack.

CVE-2026-94300: GSS-TSIG Memory Corruption

1. An attacker intercepts a GSS-TSIG-signed UDP message on the network and resends it within the validity period of the negotiated TSIG key.
2. Simultaneously, the attacker sends crafted queries directed at a zone they control. A race condition during parallel processing leads to memory corruption, named process abort, and potential code execution (stable RCE has not been confirmed in public disclosures).

CVE-2026-19630: Resource Exhaustion in Incoming Message Processing

1. DNS messages containing a large volume of specific complex structures are sent to the BIND resolver.
2. Internal processing load increases, resulting in a denial of service (DoS) caused by rapid CPU or memory exhaustion.

CVE-2026-96888: Interaction Between Redirect and Strict QNAME Minimization

1. Queries that trigger the relevant redirect handling are sent to a resolver where both redirect zones and qname-minimization strict are enabled.
2. An assertion failure occurs, causing the named process to terminate abnormally.

CVE-2026-97313: RPZ with Mixed Recursive-Only Settings

1. Target BIND instances are configured to allow recursive queries and include two or more zones with mixed RPZ (Response Policy Zone) settings of recursive-only yes and recursive-only no.
2. A specific query sequence—receiving an RD=1 (recursion desired) query followed by an RD=0 (non-recursion desired) query—triggers an assertion failure and terminates the process.

The table summarizes the public information above. Defender signals are suggestions for investigation in your own environment (Inference). Undisclosed implementation details and follow-on behavior are left unspecified.

Vulnerability / Attack Path	Attacker Action / Technique	Preconditions / Communication	Defender Signals (Impact / Artifacts)
CVE-2026-94300	Replaying GSS-TSIG signed UDP messages while simultaneously sending crafted queries to an attacker-controlled zone	GSS-TSIG enabled, UDP message interception, within key validity period	named memory corruption errors/core dumps, suspicious retransmissions of identical TSIG messages
CVE-2026-19630	Sending crafted DNS messages containing large volumes of specific complex internal structures	Path where the resolver processes crafted DNS messages	Abnormal CPU load on the named process, rapid memory consumption, response delays/timeouts
CVE-2026-96888	Name resolution requests targeting a redirect zone	redirect zones and qname-minimization strict settings enabled	named assertion failure logs (specific file names and line numbers unconfirmed), immediate crash of the named process
CVE-2026-97313	Sending a specific query sequence of a recursive request (RD=1) followed by a non-recursive request (RD=0)	Recursion permitted, RPZ with mixed recursive-only yes/no settings across multiple zones	named assertion failure logs (specific file names and line numbers unconfirmed), sudden termination of the named process

4. Attacker Positioning and Execution Location

• A remote attacker capable of sending DNS messages to the BIND service. For CVE-2026-94300, an additional condition is the ability to capture signed UDP messages and replay them within the key's validity period.

5. Perspective from Victims and Administrators

Victims

• Manifests as name resolution failures, response delays/timeouts, and intermittent loss of access to internal and external services.

Administrators and SOC

• Observed as named process crashes/assertion failures, core dump generation, spikes in CPU/memory consumption, anomalous GSS-TSIG packets, or queries with unexpected RD flag sequences.

6. Success and Failure Conditions

Success Conditions

• Running an affected version for each CVE (for standard BIND releases, CVE-2026-94300 and CVE-2026-19630 affect 9.11.0 through 9.18.50; CVE-2026-96888 and CVE-2026-97313 affect 9.16.0 through 9.18.50; all four also affect 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26). Consult ISC's version tables for Preview edition impact ranges.
• For CVE-2026-94300, successful interception of signed UDP, replay within the TSIG key validity period, and transmission of queries to an attacker-controlled zone.
• For CVE-2026-96888, the simultaneous use of redirect zones and qname-minimization strict; for CVE-2026-97313, RPZ configuration conditions in a recursion-enabled environment combined with the specific RD=1 to RD=0 query sequence.

Failure Conditions and Mitigations

• Update to fixed versions (9.20.30, 9.21.27, or Preview 9.20.30-S1) based on the operational branch and support policy. For end-of-life branches such as 9.18, migrate or verify vendor patch availability.
• ISC states that no known workarounds exist for any of the four vulnerabilities (restricting recursive access and reviewing configurations serve only as supplementary mitigations to reduce the attack surface).

7. What Happens Upon Success

• Stoppage of the DNS service on the affected server due to abnormal termination of the named process.
• Availability impact on DNS responses caused by resource exhaustion.
• Potential remote code execution in CVE-2026-94300.

8. Observable Logs

Inference: The items below are investigation candidates for your organization. Availability depends on products, permissions, configurations, and retention periods, and should be distinguished from observation records in source reports. A single event alone does not confirm attribution to this issue or successful compromise.

Email

• No email-based initial vectors have been published for this issue.

Proxy / SWG / DNS

• Review DNS query logs and packet captures to verify GSS-TSIG usage, queried zones, and RD flag transition sequences.

Endpoint / EDR

• Check for named process termination logs, assertion error records, core dumps, sudden spikes in CPU/memory usage, and service restart events (a crash alone must not be assumed to indicate successful RCE).

Identity / IdP

• Review logs for key management and validity periods of Kerberos and other credentials used by GSS-TSIG.

SaaS / Cloud

• For cloud-based DNS appliances or IaaS configurations, verify configuration changes and package update histories.

Network

• Investigate DNS packets for retransmitted identical-signature UDP packets, RD=1 queries followed by RD=0 queries, and correlate queries targeting attacker-controlled zones with named downtime timestamps.

9. Attack Success Determination

Confirmed in Public Information

ISC has published advisories for all four vulnerabilities and says it is not aware of active exploitation. Clearly distinguish between DoS (availability impact) and the potential RCE of CVE-2026-94300, and do not treat RCE as confirmed based solely on public documentation.

Organizational Assessment Criteria

• Attack Attempt Observed (Success Unconfirmed): Reached when suspicious DNS queries are detected, but no impact on named process behavior or service availability is confirmed.
• Initial Execution Confirmed: Concluding that RCE has occurred requires evidence supporting arbitrary code execution corresponding to crafted queries. Suspicious child processes or external communications are investigation candidates and cannot be confirmed in isolation. Named service termination, assertion failures, or memory corruption alone do not confirm successful RCE; attack correlation and availability impact must be evaluated separately.

10. Investigation Playbook

• Trigger: Start with running vulnerable versions, named abnormal terminations, assertion errors, CPU/memory spikes, or GSS-TSIG replay detections.
• Initial Review: Verify running versions, server roles (authoritative/caching), public exposure of recursive access, and configurations for GSS-TSIG, redirect zones, qname-minimization, and RPZ.
• Endpoint/Server Investigation: Preserve and analyze named logs, system logs, core dumps, system resource trends, and package histories.
• Identity/Cloud Investigation: Check TSIG key management status, administrator login histories, and configuration change logs.
• Subsequent Actions: Track signs of potential code execution (suspicious file generation, child process creation, external communications).
• Containment: Update to fixed versions, apply strict access restrictions to recursive query scopes, and block suspicious traffic.
• Determination Categories: Clearly distinguish stages such as contact, execution, authentication success, information retrieval, and subsequent compromise, without prematurely concluding unconfirmed successes.

11. Defense and Detection Ideas

• Single Event: Detect named assertion error logs, abnormal CPU/memory spikes, or continuous receipt of identical GSS-TSIG messages.
• Temporal Correlation: Perform correlation analysis from bursts of crafted queries -> resource spikes or assertion errors -> named process termination and automatic restart.
• Threat Hunting: Comprehensively search DNS packet captures, query logs, core dump histories, and systemd service restart logs.
• Log Limitations: Because environments lacking detailed DNS query logs make attack packet identification difficult, capturing packet data and preserving core dumps is critically important.
• Priority Actions: Prioritize immediate updates to fixed versions, internal restriction of recursive query acceptance scopes, inspection of configuration parameters, resource monitoring, and core dump preservation.

12. Facts / Inference / Hypothesis

Facts

• ISC published vulnerability advisories for four issues on October 21, 2026, and JVN issued an alert the following day, October 22.
• CVE-2026-94300 is a flaw where intercepted GSS-TSIG-signed UDP messages are replayed within the key validity period and combined with crafted queries to an attacker-controlled zone, leading to memory corruption and potential RCE.
• CVE-2026-19630 is a vulnerability that can exhaust CPU and/or memory resources via DNS messages containing large volumes of specific complex structures.
• CVE-2026-96888 (involves the simultaneous use of redirect zones and qname-minimization strict) and CVE-2026-97313 (involves mixed RPZ configurations in recursion-enabled environments receiving RD=0 after RD=1) cause named to terminate due to assertion errors.
• Fixed versions are 9.20.30, 9.21.27, and Preview 9.20.30-S1; ISC states it is unaware of any known workarounds or active exploitation.

Inference

• Not only internet-facing DNS servers, but also internal GSS-TSIG utilization environments (such as internal Active Directory integrations) and RPZ-enabled resolvers can become targets for attacks.

Hypothesis

No additional hypotheses. Unverified items are documented under "Open Questions and Further Investigation."

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	medium	Attack path exploiting DNS processing flaws from external networks (depends on configuration conditions for each vulnerability; active exploitation unconfirmed).
T1499	Endpoint Denial of Service	medium	Corresponds to availability impact caused by resolver resource exhaustion or forced termination of the named process.

14. Open Questions and Further Investigation

• Success conditions for stable code execution (RCE) and the existence of PoCs for CVE-2026-94300.
• Feasibility of reconstructing attack traffic via packet captures in individual organizations.

15. Impact on SOCs and Organizations

Organizations running BIND 9 as authoritative or caching DNS servers should immediately verify their running versions and configurations (such as GSS-TSIG, RPZ, and qname-minimization), update to supported fixed versions, and retroactively investigate named crash histories and assertion logs.

16. Summary by Persona

• For SOC: Correlate and monitor named assertion logs, abnormal CPU/memory spikes, GSS-TSIG replays, and suspicious process restarts.
• For Administrators: Immediately update BIND 9 to the fixed versions for each branch (such as 9.20.30 and 9.21.27) and restrict recursive query permissions to trusted internal networks.
• For Users: No direct actions are required for general users, but report name resolution failures or loss of internal system connectivity to administrators if encountered.