Zurück zu den Sicherheitshinweisen

Bind CVE-2026-94300

CVE-2026-94300 is a race-condition vulnerability (CWE-362) in BIND, rated CVSS 8.1 and documented by ISC. It was raised on the DirectAdmin forum for investigation: since BIND on DirectAdmin servers is typically the distribution-packaged version, the practical fix is your OS's BIND package update rather than a DirectAdmin component.

High 8.1 CVSS
DirectAdmin

Standard-Update-Befehl

cd /usr/local/directadmin/custombuild && ./build update_versions

Was das unter einer SharedLicense-Lizenz bedeutet

Race conditions in a DNS resolver/authoritative server can crash named or corrupt resolution state — and every domain the server hosts depends on that DNS service staying correct.

@DirectAdmin Support,

Could you please investigate the following security vulnerability and check whether it affects DirectAdmin or any of its supported configurations?

https://kb.isc.org/docs/cve-2026-94300

Most likely it will be a distro distributed package i believe but just to bring it to your attention.

Häufig gestellte Fragen

What is CVE-2026-94300?
It is a vulnerability in ISC BIND (a race condition, CWE-362) rated CVSS 8.1 and documented in ISC's knowledge base. It was brought to DirectAdmin's attention on the forum because BIND ships with DirectAdmin server stacks — though usually as the OS's distributed package.
Does DirectAdmin itself contain the flaw?
DirectAdmin manages BIND but does not ship its own BIND build in typical configurations — the forum thread notes the affected component is most likely the distribution-distributed package. That means the fix arrives through your OS repository, not CustomBuild.
How do I patch BIND on a DirectAdmin server?
Update the OS package: on RHEL-family systems run dnf update bind (or yum update bind), on Debian/Ubuntu apt update && apt upgrade bind9, then restart the named service. Check ISC's advisory (kb.isc.org/docs/cve-2026-94300) for affected version details.
How severe is CVE-2026-94300?
CVSS 8.1 — the top of the High band — with a race-condition (concurrency) root cause. No CVSS vector or exploitation status is listed in the data available so far; treat the package update as important on any server running public DNS.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

Roundcube 1.7.6 / 1.6.21 security updates

2026-11-09

LiteSpeed security advisory: LSQUIC and LiteSpeed Cache for PrestaShop

2026-11-04

CVE-2026-116149 – ImageMagick vulnerability

2026-10-25

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen