BIND 9 on Debian: DSA-6576-1 fixes GSS-TSIG memory corruption and three resolver crashes

Debian published DSA-6576-1 on 21 October 2026 for the bind9 package in Debian 13 (trixie). It fixes four vulnerabilities that ISC, the maintainer of BIND, disclosed the same day and rated High. The most serious, CVE-2026-94300, is a memory-corruption bug in GSS-TSIG handling that ISC says may potentially lead to remote code execution; the other three can make named exhaust resources or stop.

Debian 12 (bookworm) runs an affected BIND 9.18 build, and as of 31 October 2026 the Debian security tracker still lists it as vulnerable to all four issues.

At a glance

What the vulnerabilities are

Memory corruption with GSS-TSIG (CVE-2026-94300, CVSS 8.1)

According to ISC, replaying GSS-TSIG signed UDP messages can corrupt memory in named. An attacker who has captured a previously signed UDP message can replay it while the negotiated TSIG key is still valid; combined with crafted queries to a zone the attacker controls, this may potentially achieve remote code execution. It only matters on servers that use GSS-TSIG (Kerberos) signing, which is configured with the tkey-gssapi-keytab or tkey-gssapi-credential options.

Resolver resource exhaustion and crashes (CVSS 7.5 each)

• CVE-2026-19630: inbound DNS messages with a particular structure trigger extra processing with no limit, so a message carrying a very large number of such structures can make a BIND resolver use disproportionate CPU time and memory. This one does not depend on unusual configuration.
• CVE-2026-96888: a resolver configured with both a redirect zone and qname-minimization strict may abort with an assertion failure.
• CVE-2026-97313: a recursive server with at least two response policy (RPZ) zones, one using the default recursive-only yes and one using recursive-only no, may exit when a recursive query is followed by a non-recursive one.

ISC lists no workarounds for any of the four and says it is not aware of active exploits. None of them is in the CISA Known Exploited Vulnerabilities catalog (checked against the 30 October 2026 catalog). ISC published fixed releases for the 9.20 and 9.21 branches only (9.20.30 and 9.21.27); its vulnerability matrix covers supported branches, and that is the 9.20 branch.

Are you affected?

Check whether BIND is installed and running, and which version you have:

dpkg-query -W -f='${Package} ${Version}\n' 'bind9*'
apt policy bind9
systemctl is-active named

On trixie, anything older than 1:9.20.30-1~deb13u1 is affected. On bookworm, every current build is affected, including 1:9.18.49-1~deb12u3 from DLA-4865-1, which fixed an earlier set of BIND bugs but not these four. To see which of the configuration-dependent issues apply, print your configuration (secrets masked) and look for the relevant options:

sudo named-checkconf -px | grep -nE 'tkey-gssapi|type redirect|qname-minimization|response-policy|recursive-only'

How to update

On Debian 13 (trixie):

sudo apt update
sudo apt install --only-upgrade bind9 bind9-libs bind9-utils bind9-dnsutils bind9-host
apt policy bind9

The --only-upgrade option upgrades only the packages you already have and skips the rest. A plain sudo apt upgrade works too.

On Debian 12 (bookworm) there is nothing to install yet. Watch the bind9 tracker page and the debian-lts-announce list for a DLA. Until then, reduce who can reach the server: keep recursion limited to your own networks with allow-recursion, do not expose a resolver to the whole internet, and review whether you need GSS-TSIG, redirect zones or mixed RPZ settings at all. This narrows exposure; it does not fix the bugs. Longer term, plan the move to trixie.

Restart or reboot?

No reboot is needed. Restart the DNS service after the upgrade so the new named binary is running, then confirm the version and that it answers:

sudo systemctl restart named
named -v
dig @127.0.0.1 debian.org +short

On Debian the BIND service unit is named. Command-line tools such as dig pick up the new libraries the next time they run.

Sources

• security-tracker.debian.org/tracker/DSA-6576-1
• debian.org/security/2026/dsa-6576
• lists.debian.org/debian-security-announce/2026/msg00491.html
• security-tracker.debian.org/tracker/bind9
• security-tracker.debian.org/tracker/CVE-2026-94300
• security-tracker.debian.org/tracker/CVE-2026-19630
• security-tracker.debian.org/tracker/DLA-4865-1
• kb.isc.org/docs/cve-2026-94300
• kb.isc.org/docs/cve-2026-19630
• kb.isc.org/docs/cve-2026-96888
• kb.isc.org/docs/cve-2026-97313
• kb.isc.org/docs/aa-00913
• cve.org/CVERecord?id=CVE-2026-94300
• cisa.gov/known-exploited-vulnerabilities-catalog
• packages.debian.org/source/trixie/bind9
• bind9.readthedocs.io/en/v9.20.30/reference.html
• manpages.debian.org/trixie/bind9-utils/named-checkconf.1.en.html
• manpages.debian.org/trixie/apt/apt-get.8.en.html
• debian.org/releases