SB20261021117 - Multiple vulnerabilities in ISC BIND

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261021117

SB20261021117 - Multiple vulnerabilities in ISC BIND

Published: October 21, 2026

Security Bulletin ID SB20261021117
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2026-94300)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.

The vulnerability exists due to memory corruption in the GSS-TSIG message handling of ISC BIND's named process when concurrently processing replayed signed UDP messages. A remote attacker can capture and replay a previously signed UDP message while the negotiated TSIG key remains valid to cause the process to abort, and additionally send crafted queries to a zone under their control to potentially execute arbitrary code.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-19630)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service through CPU and/or memory exhaustion.

The vulnerability exists due to resource consumption without imposed limits in the BIND resolver's inbound DNS message processing when handling messages containing structures that trigger additional processing. A remote attacker can send a specially crafted DNS message containing a maliciously large number of these structures to exhaust CPU time and/or memory and cause a denial of service.


3) Reachable assertion (CVE-ID: CVE-2026-97313)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by triggering an unexpected exit of a BIND server.

The vulnerability exists due to a reachable assertion in BIND's response policy zone (RPZ) query handling when processing a recursive query followed by a non-recursive query. A remote attacker can send a query with recursion desired (RD=1) followed by a query with recursion disabled (RD=0) to trigger an assertion failure and terminate the server.

The server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes" and another with "recursive-only no".


4) Reachable assertion (CVE-ID: CVE-2026-96888)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by triggering unexpected termination of named.

The vulnerability exists due to a reachable assertion in the ISC BIND resolver when processing redirects with both a redirect zone and strict QNAME minimization configured. A remote attacker can send DNS queries that trigger the assertion failure to cause named to abort and exit, resulting in a denial of service.


Remediation

Install update from vendor's website.

References