NewsCompaniesFlawsGuides
Get the app

BIND DNS servers: a flaw that could let attackers take over, fixed in 9.20.30

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

ISC disclosed CVE-2026-94300, rated 8.1: replayed or crafted GSS-TSIG messages can corrupt memory in BIND 9 and may allow remote code execution. No workaround, no known attacks yet.

BIND, the software that answers DNS lookups for much of the internet, has a memory flaw that could let an attacker take over the server. There's a fix, and no workaround.

What happened

Every time you open a website or send an email, your device first asks a DNS server where to go. Much of the internet's DNS is answered by one program, BIND, maintained by the nonprofit Internet Systems Consortium. On Wednesday, ISC disclosed a flaw in it that could let an attacker corrupt the server's memory and, potentially, run their own code on it.

ISC rates it high, 8.1 out of 10. It can be triggered over the network, by someone with no account on the server. There is no workaround, only the update.[1]

Timeline

  1. Early notice. ISC sends its early notification, under its disclosure policy.[1]

  2. Public disclosure. Fixed in BIND 9.20.30 and 9.21.27, and 9.20.30-S1 for the Supported Preview Edition.[1]

  3. HARD publishes its article, at High.

  4. No known attacks. ISC says it isn’t aware of any active exploits. That window is when to update.[1]

What's wrong

The flaw is in how BIND handles messages signed with GSS-TSIG, a way for a DNS server to check that an update really came from a trusted machine. Organisations mostly use it to let computers in a Microsoft Active Directory network update their own DNS records. According to ISC, an attacker who captures one of these signed messages can replay it while its key is still valid and corrupt the server's memory. By sending crafted queries for a zone they control, they may be able to go further and run code on the server.

Affected: BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26, plus the matching Supported Preview Edition releases. ISC's advisory doesn't say whether servers without GSS-TSIG set up are safe, so treat any server in those ranges as needing the update. It also lists no fix for the 9.18 line: if you're on 9.18 or older, the way out is 9.20.30.

Whoever runs your DNS decides where every one of your clicks really goes.

Who is affected

You almost certainly don't run BIND yourself. But your company might, and so might the family office, the school, the building's IT contractor, or the hosting company behind your website. A DNS server that's been taken over can quietly send people to the wrong place: a copy of the bank, a fake sign-in page, a mail server that isn't yours. The people affected never see a warning, because the address they typed was right.

ISC found the flaw in its own testing, and Dave Aitel of OpenAI found and reported it independently. Two separate teams arriving at the same bug is a reminder of how quickly these flaws are now being found, by defenders and attackers alike.

How this reaches a family

  1. Someone else’s DNS serverYour company, family office or web host runs BIND to answer for its names.
  2. HARDEngineer and Secure DNSYour engineer asks whoever runs IT for you whether they use BIND and checks the fix is in. At home, Secure DNS answers your devices’ lookups, filtered, so they don’t depend on a server you can’t see.See how it works
  3. A crafted messageAn attacker sends the server messages built to corrupt its memory.
  4. Names point somewhere elseWhoever controls the server decides where email and websites under those names really go.
Where HARD comes in.With HARD, the greyed-out steps don’t happen.

What to do

  1. Ask whoever runs IT for you one question. Your company, the family office, your IT contractor: do any of our servers run BIND, and which version? If it's in the affected ranges, it should be on 9.20.30 or 9.21.27 now.
  2. If you're on 9.18 or older, plan the move. ISC hasn't listed a fixed 9.18 release. Upgrading to 9.20.30 is the fix.
  3. Ask your web host and email provider. If they run their own DNS on BIND, a short confirmation that they've updated is a reasonable thing to expect.
  4. Keep your own devices on safe DNS. HARD's Secure DNS sends your lookups to Cloudflare, encrypted, rather than to whatever server the network you're on happens to use.

Or have someone check for you. Knowing which servers your family's email, websites and home network depend on, and making sure they're patched the week a flaw like this lands, is what private cybersecurity is for.

  • CVE-2026-94300 Not on CISA’s list of flaws being used in attacks. Look it up in Search.

References

Checked against the sources. Where ISC hasn't said something, neither have we.

  1. ^ ISC. “CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory”. ISC's advisory: affected and fixed versions, severity 8.1, no workarounds, no known active exploits.
  2. CVE Program. “CVE-2026-94300”. The public CVE record.
  3. ISC. “BIND 9 Security Vulnerability Matrix”. Which BIND releases are affected by which flaws.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.