8.1

CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory

Awaiting analysis
AliasesDEBIAN-CVE-2026-94300UBUNTU-CVE-2026-94300ALPINE-CVE-2026-94300
Published 21-10-2026Last modified 22-10-2026

Vulnerability summary

CVE-2026-94300 is a high (CVSS 8.1) vulnerability in isc bind 9. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 61.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 8.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.95%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 2
MGASA-2026-0541OPENSUSE-SU-2026:12231-1USN-8969-1

Timeline

  1. 21-10-2026
    PublishedVulnerability first disclosed.
  2. 22-10-2026
    Last modifiedVulnerability information updated.

Description

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.95%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

22-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard7 products
  • bindAll versions (No fix recorded)
  • bind-devAll versions (No fix recorded)
  • bind-dnssec-rootAll versions (No fix recorded)
  • bind-dnssec-toolsAll versions (No fix recorded)
  • bind-libsAll versions (No fix recorded)
Wolfi7 products
  • bindAll versions (No fix recorded)
  • bind-devAll versions (No fix recorded)
  • bind-dnssec-rootAll versions (No fix recorded)
  • bind-dnssec-toolsAll versions (No fix recorded)
  • bind-libsAll versions (No fix recorded)
Ubuntu3 products
  • bind9All versions (No fix recorded) | < 1:9.18.39-0ubuntu0.22.04.8 | < 1:9.18.39-0ubuntu0.24.04.9 | < 1:9.20.24-1ubuntu3.1 | < 1:9.20.24-1ubuntu0.5
  • bind9-libsAll versions (No fix recorded)
  • isc-dhcpAll versions (No fix recorded)
Alpine1 product
  • bind< 9.20.30-r0
Debian1 product
  • bind9All versions (No fix recorded) | < 1:9.20.30-1~deb13u1 | < 1:9.20.30-1
Isc1 product
  • bind 9≥ 9.11.0, ≤ 9.18.50 | ≥ 9.20.0, ≤ 9.20.29 | ≥ 9.21.0, ≤ 9.21.26 | ≥ 9.11.3-S1, ≤ 9.18.50-S1 | ≥ 9.20.9-S1, ≤ 9.20.29-S1

6 vendors · 20 products

References

8 links