PT-2025-29825 · Isc · Bind

Published 2025-07-16 · Updated 2025-08-01 · CVE-2025-40776

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.3-S1 through 9.16.50-S1 BIND 9 versions 9.18.11-S1 through 9.18.37-S1 BIND 9 versions 9.20.9-S1 through 9.20.10-S1

Description A named caching resolver configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue could allow an attacker to manipulate the resolver's cache, potentially leading to redirection or data compromise.

Recommendations BIND 9 versions 9.11.3-S1 through 9.16.50-S1: Update to a version beyond 9.16.50-S1. BIND 9 versions 9.18.11-S1 through 9.18.37-S1: Update to a version beyond 9.18.37-S1. BIND 9 versions 9.20.9-S1 through 9.20.10-S1: Update to a version beyond 9.20.10-S1.

Fix

DoS

Weakness Enumeration

CWE-349

Related Identifiers

CVE-2025-40776

Affected Products

Bind

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2025-40776 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40776 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-40776 · Vendor Advisory
• https://kb.isc.org/docs/cve-2025-40776 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-40776 · Vendor Advisory
• https://twitter.com/Iambivash007/status/1946473218421952572 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945637941168005166 · Twitter Post
• https://t.me/netlas/441 · Telegram Post
• https://t.me/pentestingnews/64720 · Telegram Post
• https://twitter.com/Iambivash007/status/1946483227339735184 · Twitter Post
• https://twitter.com/CVEnew/status/1945482454204297593 · Twitter Post
• https://t.me/TheDarkWebInformer/19079 · Telegram Post
• https://twitter.com/Netlas_io/status/1946109016939114569 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2025-40776 · Note
• https://twitter.com/fofabot/status/1946179124776874076 · Twitter Post