This article was published on October 23, 2026.
Preface: BIND 9 is the de facto standard and most widely deployed authoritative DNS server software for enterprise Linux environments.
While BIND 9 historically commands up to 80% market share in traditional on-prem data centers, modern cloud-native Linux environments frequently favor lightweight alternatives like CoreDNS or cloud-managed DNS.
Background: The original design for BIND 9 DNS using GSS-TSIG over UDP focuses on establishing a secure, authenticated session context for dynamic DNS updates (DDNS). Rather than using pre-shared static keys (as in standard TSIG), it relies on a standardized, multi-step negotiation protocol carried over standard DNS message formats
The following instructions require the use of the accompanying infographics.
The Server-Side Memory Weakness: Dynamic TKEY Object Lifetime Management
In BIND 9, when a client negotiates a GSS-TSIG session, the server creates a dynamic state structure in memory called a TKEY context object. This object keeps track of the negotiated encryption keys, security context handles, and reference counters.
The vulnerability is rooted in a Use-After-Free (UAF) or Double Free design flaw:
1. The Shared State Race Condition: When an attacker sends multiple identical, valid GSS-TSIG packets simultaneously over stateless UDP, BIND 9 processes them concurrently using multiple execution threads.
2. The Lifetime Count Failure: Thread A processes the first packet, finishes the transaction, determines that the operation is complete, and initiates the teardown of the dynamic TKEY security object from the heap memory.
3. The Dereference Crash (Use-After-Free): Concurrently, Thread B is processing the replayed packet. Because UDP lacks sequence numbers, Thread B assumes the dynamic TKEY memory pointer is still valid. It attempts to access or free the exact same memory address that Thread A just destroyed.
Vulnerability details: Replaying GSS-TSIG signed UDP messages can result in memory corruption in “`named`”. An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
BIND 9’s official updates (9.20.30 and 9.21.27) added thread serialization mechanisms to ensure that if Thread B receives a concurrent replay, it is forced to lock and verify the context or discard the packet completely before hitting the heap routines.
Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-94300