Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.
ISC DHCP is not affected. CVE-2026-94300 is a memory corruption flaw in the BIND name server (named) in its handling of replayed GSS-TSIG signed UDP messages. It requires a server that has GSS-TSIG enabled (for example tkey-gssapi-keytab or Kerberos-based update-policy). ISC DHCP bundles BIND 9.11.14 libraries (libisc, libdns, libisccfg) and builds them with --without-gssapi (bind/Makefile.in), so the GSS-TSIG code in libdns (gssapi_link.c, gssapictx.c, and the DST_ALG_GSSAPI paths in dst_api.c) is not compiled in. DHCP's own code (client, common, server, relay, omapip, dhcpctl) does not use GSS-TSIG or TKEY. OMAPI authentication uses plain HMAC keys, and DDNS updates use only TSIG with HMAC keys. DHCP also does not run a name server that could accept such messages. The --with-ldap-gssapi option used in the dhcp build is for Kerberos authentication to OpenLDAP and is unrelated to BIND's GSS-TSIG.