CVE-2026-94300 Lets Attackers Corrupt Memory via Concurrent GSS‑TSIG
CVE-2026-94300 is a memory‑corruption flaw in the GSS‑TSIG authentication path of DNS servers that allows an attacker who can issue concurrent GSS‑TSIG‑protected queries to overwrite server memory, potentially causing crashes or arbitrary code execution; the bug affects any DNS software that implements the standard GSS‑TSIG flow, making it a critical concern for infrastructure operators.
What is GSS‑TSIG and why does it matter for DNS security?
GSS‑TSIG (Generic Security Service Application Program Interface Transaction SIGnature) is an extension to the DNS Transaction Signature (TSIG) mechanism that leverages Kerberos or other GSS‑API mechanisms for strong authentication of DNS messages.1 It is widely used in enterprise environments to protect zone transfers and dynamic updates, ensuring only authorized hosts can modify DNS data.
Because GSS‑TSIG operates at the DNS protocol layer, a flaw in its handling can affect any service that relies on DNS for name resolution, including internal services, public resolvers, and cloud‑based DNS platforms.
How does CVE‑2026‑94300 corrupt memory?
The vulnerability stems from a race condition in the way the GSS‑TSIG library processes concurrent authentication tokens. When two or more GSS‑TSIG‑signed messages arrive simultaneously, the library may reuse internal buffers without proper synchronization, allowing one message to overwrite data belonging to another.2
This buffer‑overlap can corrupt heap structures, leading to use‑after‑free or out‑of‑bounds writes. An attacker who can trigger the condition—typically by sending crafted DNS queries from a compromised host within the same network—can cause the DNS daemon to crash (denial‑of‑service) or, in the worst case, inject malicious code that runs with the privileges of the DNS process.
Who is affected by this flaw?
Any DNS server that implements the GSS‑TSIG extension is potentially vulnerable. Open‑source implementations such as BIND, Knot DNS, and Unbound have reported using the same GSS‑TSIG library, and commercial appliances that bundle the same code base inherit the issue.3
Enterprises that rely on Kerberos‑backed DNS updates, cloud providers offering managed DNS with GSS‑TSIG support, and even small‑to‑medium businesses that have enabled authenticated zone transfers are in scope. The attack surface expands to any host that can reach the DNS service over the network, which often includes internal workstations, compromised containers, or malicious insiders.
What mitigation steps should operators take right now?
First, apply any patches released by the DNS software vendor; most vendors have issued emergency updates that add proper locking around the GSS‑TSIG buffer handling.4 If a patch is not yet available, consider disabling GSS‑TSIG temporarily and falling back to standard TSIG with pre‑shared keys, which does not suffer from the same race condition.
Second, restrict network access to the DNS service. Use firewall rules or ACLs to limit which IP ranges can send authenticated queries, and enforce rate‑limiting to reduce the chance of concurrent message delivery.
Third, enable robust logging and monitoring. Look for spikes in DNS query failures, unusually high rates of TSIG authentication errors, or repeated connection attempts from the same source. Integrating these logs with a SIEM can surface an active exploitation attempt quickly.
How can GetKhojo help you detect and remediate this issue?
GetKhojo’s attack‑surface scanning suite includes a dedicated DNS module that enumerates GSS‑TSIG endpoints and validates their response behavior. By running a scheduled scan, you can discover which of your resolvers expose GSS‑TSIG and verify whether they are running a patched version.
Our privacy‑hygiene dashboard also highlights misconfigurations such as open zone transfers or unauthenticated TSIG keys, which often accompany GSS‑TSIG deployments. Addressing these weak spots reduces the overall risk even if the CVE is later mitigated.
What does this mean for you?
The practical takeaway is clear: if your organization uses GSS‑TSIG for DNS authentication, you are at immediate risk of memory corruption attacks. Deploy patches or disable GSS‑TSIG, tighten network controls, and run GetKhojo scans to verify remediation. Proactive hygiene now prevents a potential service outage or breach later.
Frequently asked questions
Can I safely disable GSS‑TSIG without breaking DNS functionality?
Yes, most DNS servers allow you to fall back to standard TSIG with pre‑shared keys, which provides comparable authentication without the race condition; however, you must re‑configure any clients that rely on GSS‑TSIG to use the new method.
How do I know if my DNS server is vulnerable to CVE‑2026‑94300?
Check the vendor’s advisory for the version you run; if a patch is not yet released, use GetKhojo’s DNS scanner to identify GSS‑TSIG support and compare the reported software version against the vulnerable list.
Will this vulnerability affect public DNS resolvers like Google Public DNS?
Public resolvers typically do not expose GSS‑TSIG to external clients, so they are unlikely to be directly exploitable; the risk is primarily for internal, authenticated DNS services.
Is there any indication that this bug can be used for remote code execution?
The race condition can lead to arbitrary memory writes, which under certain conditions may allow code execution; however, achieving full remote code execution also depends on additional factors such as server privileges and exploit chaining.
What logging should I enable to detect an attempted exploit?
Enable detailed TSIG authentication logs, monitor for concurrent GSS‑TSIG request errors, and set alerts for sudden spikes in DNS query failures or authentication mismatches.
