---
title: DNS resolver patch day: BIND 9.20.30 fixes a GSS-TSIG memory corruption that may allow RCE (CVSS 8.1); Unbound 1.26.2 fixes five bugs | ctxsec
url: https://ctxsec.com/items/bind-9-20-30-unbound-1-26-2-dns-fixes-oct-21
description: ""
status: "confirmed (ISC and NLnet Labs advisories, Oct 21); no active exploitation reported"
published: 2026-10-22
---

> 

[← Cybersecurity News](/news) · [markdown](/items/bind-9-20-30-unbound-1-26-2-dns-fixes-oct-21.md)

confirmed (ISC and NLnet Labs advisories, Oct 21); no active exploitation reported

2026-10-22

### DNS resolver patch day: BIND 9.20.30 fixes a GSS-TSIG memory corruption that may allow RCE (CVSS 8.1); Unbound 1.26.2 fixes five bugs

**ISC BIND 9** (Oct 21, upgrade to **9.20.30** or 9.21.27; ISC lists no workarounds and knows of no active exploits):

- **CVE-2026-94300** (8.1): replaying captured GSS-TSIG-signed UDP messages while the TSIG key is still valid, along with crafted queries to an attacker-controlled zone, can corrupt memory in `named`, with potential remote code execution. Affects 9.11.0 to 9.18.50, 9.20.0 to 9.20.29 and 9.21.0 to 9.21.26. Mainly relevant where GSS-TSIG (Active Directory-style dynamic updates) is used.
- **CVE-2026-19630** (7.5): unbounded processing of certain inbound message structures lets one message exhaust CPU and memory on a resolver.
- **CVE-2026-96888** (7.5): crash when a redirect zone is combined with `qname-minimization strict`.
- **CVE-2026-97313** (7.5): crash on recursive servers with two RPZ zones that have different `recursive-only` settings.

**NLnet Labs Unbound 1.26.2** (Oct 21): **CVE-2026-97206** (High), a DNS-over-QUIC path-migration use-after-free that a remote DoQ client can use to crash multi-threaded servers (1.22.0 to 1.26.1); CVE-2026-50106 and CVE-2026-35501, DNSSEC trust-island bypasses; CVE-2026-96405, decompression-work CPU exhaustion; and CVE-2026-109125, a cache-poisoning side channel through `unwanted-reply-threshold`. Patches are available for anyone who can't upgrade.

Sources: [ISC: CVE-2026-94300 (GSS-TSIG memory corruption)](https://kb.isc.org/docs/cve-2026-94300) · [ISC BIND 9 Security Vulnerability Matrix](https://kb.isc.org/docs/aa-00913) · [NLnet Labs: Unbound security advisories](https://www.nlnetlabs.nl/projects/unbound/security-advisories/) · [oss-security: Unbound 1.26.2 addresses multiple CVE items (Oct 21)](https://www.openwall.com/lists/oss-security/2026/10/21/11)