> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Four high-severity flaws hit BIND, the most common DNS software, one may allow code execution
- URL: https://globalfeed.ai/en/four-high-severity-flaws-hit-bind-the-most-common-dns-software-one-may-allow-code-execution/
- Published: 2026-10-23T00:45:39.000Z
- Updated: 2026-10-23T00:45:39.000Z
- Description: ISC fixed four high-severity vulnerabilities in BIND 9 on the same day. The most serious lets replayed GSS-TSIG-signed messages corrupt memory and potentially execute code remotely. Fixed versions are 9.20.30 and 9.21.27, with no workarounds.
- Author: GlobalFeed Editor
- Tags: BIND, DNS, ISC, vulnerability, cybersecurity, x-ISCdotORG, dil-en, elle

Internet Systems Consortium (ISC), which develops BIND 9, one of the most widely used DNS server programs on the internet, released versions fixing four high-severity vulnerabilities on October 21, 2026\. The most serious, according to [ISC's CVE-2026-94300 advisory](https://kb.isc.org/docs/cve-2026-94300?ref=globalfeed.ai), is a remotely exploitable bug that corrupts memory. ISC describes the impact as program abort and/or potential remote code execution, with a CVSS 3.1 score of 8.1.

## What BIND is

BIND is the oldest and most widely used server software for running DNS, the system that turns domain names into IP addresses. It runs both on authoritative servers that publish a domain's own records and on resolvers that answer users' queries. It is common in corporate networks, internet service providers and hosting companies.

## The most serious flaw: GSS-TSIG

GSS-TSIG is a way to sign DNS messages using authentication systems such as Kerberos, used especially to update DNS records securely in Active Directory environments. According to ISC's advisory, replaying GSS-TSIG-signed UDP messages can corrupt memory in BIND's named process. The attacker needs to capture a previously signed message and replay it while the key is still valid, and also send crafted queries to a zone they control. ISC says the flaw is remotely exploitable; code execution is described as a possibility that depends on these extra steps. The advisory does not separately state which settings make a server vulnerable.

Affected versions are 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26; ISC's Supported Preview Edition (S1) builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1 are also affected. ISC says it found the flaw in internal testing and that Dave Aitel of OpenAI independently discovered and responsibly reported it.

## The other three flaws

- **CVE-2026-19630 (CVSS 7.5):** A resolver receiving large numbers of messages with a particular structure uses excessive CPU and memory, leading to denial of service. Found in ISC's internal testing.
- **CVE-2026-96888 (CVSS 7.5):** A resolver with a "redirect" zone and strict QNAME minimization (qname-minimization strict) may terminate unexpectedly while processing the redirect.
- **CVE-2026-97313 (CVSS 7.5):** A server using two RPZ zones, one with recursive-only yes and one with recursive-only no, may exit on a particular query sequence.

The last two were reported by Vitaly Simonovich. For all four, ISC knows of no workarounds and says it is not aware of any active exploits.

## What to do

ISC recommends upgrading to **9.20.30** or **9.21.27** for all four flaws, and to 9.20.30-S1 for S1 users. The advisory lists no fix for the 9.18 branch, and ISC's download page marks 9.18.50 as end of life, so users of that branch need to move to the supported 9.20 branch. ISC also offers updated packages through its own Copr, Launchpad, Debian and Docker channels; distributions' own packages should be tracked through their security advisories.

Organizations using GSS-TSIG with Active Directory in particular should update their DNS servers first and review who can reach dynamic updates. Service providers and hosting companies running resolvers should not delay updating because of the denial-of-service flaws either.

The details rest on ISC's security advisories and vulnerability matrix. The scores are ISC's own assessment; code execution is listed in the advisory as a possible outcome, and there is no public exploit yet. Because DNS infrastructure sits underneath almost every internet service, it is worth watching server logs for unusual crashes and restarts after patching. Follow assessments from independent security researchers for other perspectives.