ISC BIND software faces multiple security vulnerabilities

Internet Systems Consortium (ISC) has released advisories regarding four vulnerabilities affecting the BIND 9 DNS server. These flaws include CVE-2026-94300, a memory-corruption vulnerability with a CVSSv3 score of 8.1 that could potentially lead to remote code execution. This specific exploit requires an attacker to first capture a GSS-TSIG signed UDP message.

Other identified vulnerabilities include CVE-2026-19630, CVE-2026-97313, and CVE-2026-96888, which carry CVSSv3 scores of 7.5. These issues involve risks related to malicious DNS messages, specific recursive server configurations involving RPZ zones, and resolvers utilizing both redirect zones and strict QNAME minimisation.

While internet scans have identified approximately 19.4 million assets matching the BIND fingerprint, experts note that this figure does not represent the total number of vulnerable systems. Fingerprinting identifies the software but cannot distinguish between specific versions or differentiate between authoritative-only servers and recursive resolvers.