BIND 9 flaw enables potential remote code execution through replayed DNS traffic
BIND developers disclosed a high-severity vulnerability that can allow malicious actors to inject and execute code on affected DNS servers. The issue was published on October 22 and is exploitable over the internet, making version checks and upgrading the relevant BIND installations the central response for operators.
The attack relies on replaying intercepted GSS-TSIG-signed UDP packets while the negotiated TSIG key remains valid. The vulnerable code treats the repeated packet as new instead of rejecting it. If an attacker also sends specially prepared requests to a zone they control, the resulting memory errors can potentially lead to code injection and execution.
The vulnerability is tracked as CVE-2026-94300 and has a CVSS score of 8.1, classified as high risk. BIND maintainers say the flaw can be exploited from the internet. That matters particularly for installations whose DNS service is reachable from outside the organization, although the supplied advisory does not quantify the number of exposed systems or describe observed attacks using this flaw.
Affected releases include BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26. The listed preview branches are affected as well. The fixed releases named by the developers are BIND 9.20.30 and 9.21.27; ISC support customers are directed to BIND Supported Preview Edition 9.20.30-S1.
The advisory does not provide a workaround, so operators should use the release information to identify affected systems and move to the applicable fixed version. The maintainers say they are not aware of active exploitation of this vulnerability. That statement describes the current knowledge reported in the advisory, not a guarantee that exposed servers are safe to leave unpatched.