The Internet Systems Consortium (ISC) said on 22 October 2026 that BIND 9 has a memory flaw, tracked as CVE-2026-94300. The flaw is in named, the BIND 9 server program. ISC said an attacker who captured a message signed with GSS-TSIG, a signing method for DNS traffic, could send it again. That works only while the negotiated signing key is still valid. If the attacker also sends crafted queries to a zone they control, ISC said they may be able to run code remotely. A crash is the other listed outcome.
ISC's advisory leaves several points open. It gives no patched version numbers and no list of affected versions, and it points readers to a separate security matrix. It gives no numeric severity score, only the CVSS vector, which marks the attack as network-based but hard to carry out. It does not say whether anyone has used the flaw in attacks. ISC said it found the flaw in internal testing. Dave Aitel of OpenAI also found it independently and reported it.
Teams that run BIND 9 should check their version and move to the patched release closest to it, as ISC advises. ISC rates the attack as complex, but the possible harm to data and uptime is high. ISC patches only supported versions.