CVE-2026-94300

What it actually does

Replaying captured GSS-TSIG signed UDP messages against named while the TSIG key remains valid triggers memory corruption; attacker-controlled queries to a malicious zone can then be used to achieve remote code execution.

Why it matters to the business

Compromise of authoritative or recursive DNS servers can cause widespread name-resolution outages, data exfiltration, or use of the servers as an internal foothold; the flaw affects widely deployed BIND 9 releases and requires prompt patching.

How an attack unfolds

An attacker first captures a valid GSS-TSIG-signed UDP message, then replays it to the target server while the negotiated key is still accepted; simultaneously the attacker issues specially crafted queries against a zone they control, triggering the memory corruption path that may yield remote code execution.

How to fix it

Upgrade affected BIND 9 installations to the fixed versions listed in the vendor advisory (bind-main on Red Hat: 9.20.30-0.1.hum1 per RHSA-2026:87309). Disable GSS-TSIG or restrict UDP message replay windows where upgrades cannot be applied immediately.

How to confirm the fix worked

Verify the installed named binary or package version matches or exceeds the fixed release; confirm that GSS-TSIG is either disabled or that TSIG key lifetimes have been shortened; re-test with replayed signed UDP traffic in a lab environment to ensure the memory-corruption condition no longer occurs.

Typical attack path

1. Capture GSS-TSIG signed UDP message in transit
2. Maintain access to the negotiated TSIG key before it expires
3. Replay the captured signed message to the victim named instance
4. Send attacker-controlled queries for a zone under attacker control
5. Trigger memory corruption and obtain remote code execution

How to detect it

Review named process logs and network captures for repeated GSS-TSIG-signed UDP messages originating from unexpected sources; look for anomalous memory-allocation failures or crashes in named shortly after receipt of signed traffic; correlate with queries to attacker-controlled zones.

What your security team should do

• Apply the vendor-supplied update to 9.20.30-0.1.hum1 (or equivalent) within the next maintenance window
• Inventory all BIND 9 deployments and prioritize those reachable from untrusted networks
• Temporarily disable GSS-TSIG or enforce short TSIG key lifetimes until patching is complete
• Monitor for any public exploit code that may raise the current low EPSS score