ISC releases BIND 9.20.30 and 9.21.27, patching four flaws including an RCE
ISC has dropped its fourth monthly BIND security release of the year. Four High-rated vulnerabilities go with it, and one can lead to remote code execution.
BIND operators had another reason to open the release notes this week. ISC, the New Hampshire-based nonprofit that maintains DNS software, published two maintenance releases on 21 October 2026: 9.20.30 for the current stable branch and 9.21.27 for the development line. Both patch four vulnerabilities, all rated High, and ISC says it isn't aware of any active exploitation.
That's a quiet count heading into October. September swallowed fourteen flaws in a single release. But don't let the low number fool you. One of these four carries a working path to remote code execution, which places it ahead of most things on a monthly BIND docket.
Under the hood
CVE-2026-94300 is the one that actually matters. It lives in how named, BIND's server process, handles GSS-TSIG sessions. A GSS-TSIG session negotiated through TKEY is shared across every message signed or verified with that key. Before the fix, concurrent signed messages could corrupt the Kerberos-owned state and terminate named. The ticket is GitLab #6320.
The fix serializes access to that shared state. CVSS puts it at 8.1, the highest score in this batch.
The exploitation complexity, though, is High. To pull this off an attacker would need to capture a previously signed UDP message, replay it while the TSIG key is still valid, and send crafted queries to a zone they control all at once. That's not a spray-and-pray script. Still, RCE is RCE, and ISC flagged it as worth prioritizing.
The other three are denial-of-service variants, all rated High at 7.5.
CVE-2026-19630 is the biggest headache for busy resolvers. Crafted inbound messages with too much name compression force named to burn CPU and memory while expanding domain names. ISC's description is blunt: an attacker can "saturate all worker threads with very little traffic and time out legitimate queries." The fix bounds name expansion and returns a FORMERR once you cross the line. GitLab #5932.
CVE-2026-96888 needs a very specific setup. You need a resolver running both a "redirect" zone and qname-minimization strict, then hit it with an NXDOMAIN response and named aborts on an assertion failure. Credited to external researcher Vitaly Simonovich.
CVE-2026-97313 is equally particular. A recursive server has to allow recursion, hold at least two Response Policy Zone zones with conflicting recursive-only settings, and receive a toggle between recursion-desired and non-recursive queries. Then it exits. Also Simonovich.
None of the three has a workaround, and none is broadly exploitable either. They bite only on specific, often unusual, configurations.
For the record, ISC credited Dave Aitel of OpenAI with reporting CVE-2026-94300. A reminder that LLMs aren't the only fresh variable in this story.
An LLM-driven cadence
This is ISC's fourth consecutive monthly BIND security release of 2026. The pattern traces back to a May blog post from Vicky Risk, "Prepare for more frequent BIND security updates," in which she laid out the new operating conditions.
"Large language models are making it much easier to find software vulnerabilities in open source," Risk wrote, adding that ISC was triaging reports "at a rate that exceeds 10X the historic levels." The response: fold security fixes into every monthly release and publish reproduction tests alongside the disclosure. BIND 9.22, the next stable branch, got pushed to at least Q4 2026.
There's a wrinkle in the recent timeline worth flagging. The release before this one, 9.20.29, landed on 11 September 2026. The one before that, 9.20.28, was quietly withdrawn after pre-release testing surfaced a regression. A withdrawn release. That's not exactly standard practice.
ISC says the accelerated cadence is temporary, with a hoped-for return to normal timing in Q1 2027. Four months out, that still reads like a projection.
To upgrade, grab the latest maintenance release on your branch. That's 9.20.30 for stable, 9.21.27 for development. ISC can no longer always pinpoint which minor version introduced a given flaw, so the guidance is "update to the latest" rather than aiming at a specific number.
If your deployment uses GSS-TSIG for Kerberos-based dynamic updates, prioritize CVE-2026-94300. It's the only flaw in this batch with a code-execution path. Review any resolver running a redirect zone plus strict QNAME minimization, or one with conflicting RPZ recursive-only settings, against the last two flaws.
Watch for ISC's own packages and container images, which were slated for release later on the same day. They can lag the source tarball, and OS-vendor builds sometimes lag those too.
Head here for the stable release, and here for the development branch.
And if you're still on 9.18, now is the time to plan the move to 9.20. That branch reached end-of-life in June 2026, and newer flaws won't be backported. ISC's advisory doesn't mince words: EOL versions should be assumed to be vulnerable to new CVEs.
