Search: CVE-2026-94300

CVE-2026-94300 is a high-severity vulnerability in ISC BIND 9 that involves a double free memory corruption triggered by replaying GSS-TSIG signed UDP messages. An attacker capable of capturing a previously signed UDP message can replay it while the TSIG key remains valid. By sending crafted queries to a zone controlled by the attacker, remote code execution may be possible. This affects multiple BIND 9 versions including 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, and 9.21.0 through 9.21.26, including certain S1 variants.