BIND9 hit by high-severity GSS-TSIG replay bug enabling potential RCE (CVSS 8.1)
basedjensen · x · 2026-10-22
ISC has disclosed a high-severity flaw (CVSS 8.1) in BIND 9: replaying GSS-TSIG signed UDP messages can corrupt memory in named. An attacker who captures a previously signed UDP message can replay it while the negotiated TSIG key is still valid, and by sending crafted queries to a zone they control may achieve remote code execution.
Affected versions
- BIND: 9.11.0–9.18.50, 9.20.0–9.20.29, 9.21.0–9.21.26
- Supported Preview Edition: 9.11.3-S1–9.18.50-S1, 9.20.9-S1–9.20.29-S1
Impact is memory corruption leading to program abort and/or potential RCE. Anyone running DNS infrastructure should patch immediately.
More from Infra
- Can a $100 MacBook Pro M2 24GB serve local LLMs for Home Assistant? — Ejo2001 · 2026-10-22
- Tune your threshold before adding an LLM judge: optimal escalation rate was 0% — Reasonable_Royal_621 · 2026-10-22
- Where your $20 Claude subscription goes: an interactive AI value-chain explainer — aishashok14 · 2026-10-22
- llama.cpp WebGPU adds Q2_0 support, Ternary Bonsai prefill jumps ~50x to 2000 t/s — pmttyji · 2026-10-22
- CVE-2026-111943: Compromised intermediate certificate authority discovered — keks24 · 2026-10-22
- AI's hidden storage bill: an 8-second video leaves 500MB behind — MIT Tech Review AI · 2026-10-22