BIND: three DNS flaws with different configuration requirements
CERT-FR has issued a BIND advisory. NVD describes specific GSS-TSIG, redirect-zone and RPZ conditions. Check the server configuration as well as its version.
Going deeper
Generated image · SecuFocus
At a glance
Key points
Do you administer a BIND DNS server? CERT-FR’s 22 October advisory directs you to the publisher’s fixes. Three NVD records describe different paths to memory corruption or a service crash. Using DNS on your computer does not mean you administer that software yourself.
Three CVEs do not describe one attack
For CVE-2026-94300, NVD describes replaying previously captured, GSS-TSIG-signed UDP messages while the negotiated key remains valid. Combined with crafted queries to an attacker-controlled zone, the memory corruption could potentially allow remote code execution. This is not a claim that any DNS query is sufficient.
CVE-2026-96888 concerns a resolver configured with both a redirect zone and qname-minimization strict. Processing a redirect can then cause an assertion failure.
CVE-2026-97313 requires a recursive server with at least two RPZ zones: one with recursive-only yes, the other with recursive-only no. A sequence of recursive and non-recursive queries can crash the service. Do not confuse those conditions with the first flaw’s prerequisites.
Published boundaries do not cover every branch
CERT-FR lists 9.20.30 and 9.21.27 for BIND, and 9.20.30-S1 for Supported Preview Edition. NVD’s descriptions also include versions in branch 9.18 through 9.18.50; the CERT-FR advisory read here gives no fixed 9.18 version. That omission is not evidence that the branch is safe.
The three NVD responses read here do not yet contain CPE configurations. The conditions above come from their descriptions. An inventory relying only on CPE data can therefore miss that information. For a distribution package, check the advisory and complete fixed package number for your system.
The DNS operator needs to apply the fix
If you maintain BIND, identify its branch and configured features, then apply the appropriate fix through your maintenance process. Afterwards, verify the version actually running and expected DNS resolution. Keep a configuration copy and a recovery path before changing the service.
If the resolver belongs to your ISP, a DNS provider or your organization, that operator is responsible for patching it. Changing a browser setting does not update their server. The cited sources do not establish active exploitation here, and SecuFocus has not reproduced these flaws.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.