Security1 hOctober 24, 2026, 00:45

ISC BIND 9 hit by four remote flaws, including potential RCE

ISC disclosed four vulnerabilities in BIND 9: CVE-2026-94300 lets attackers replay GSS-TSIG-signed UDP messages to cause memory corruption and potential RCE, while three other CVEs enable remote denial of service. Affected branches include 9.11.0–9.18.50, 9.20.0–9.20.29 and 9.21.0–9.21.26; fixes ship in 9.20.30 and 9.21.27.

DEV Community

Open source

CVE-2026-94300: replaying signed GSS-TSIG UDP messages corrupts memory
CVE-2026-19630, 96888 and 97313 cause denial of service via crafted queries
Affected: BIND 9.11.0–9.18.50, 9.20.0–9.20.29 and 9.21.0–9.21.26
Fixed in 9.20.30, 9.21.27 and Preview 9.20.30-S1

#ISC#BIND

CERT-In flags 14 ISC BIND flaws enabling cache poisoning and zone injection

Security

ISC patches 14 vulnerabilities in BIND 9 security update

Security

HPE patches 72 ArubaOS flaws, including eight max-severity RCE and auth bypass bugs

Security

ISC BIND 9 hit by four remote flaws, including potential RCE

CERT-In flags 14 ISC BIND flaws enabling cache poisoning and zone injection

ISC patches 14 vulnerabilities in BIND 9 security update

HPE patches 72 ArubaOS flaws, including eight max-severity RCE and auth bypass bugs

NGINX Patches 5 Flaws, Including Possible RCE and TLS Bug