PT-2025-43372 · Isc +6 · Bind +6

Published

2025-10-22

·

Updated

2025-11-10

·

CVE-2025-40778

CVSS v3.1
8.6
VectorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions BIND versions 9.11.0 through 9.16.50 BIND versions 9.18.0 through 9.18.39 BIND versions 9.20.0 through 9.20.13 BIND versions 9.21.0 through 9.21.12 BIND Supported Preview Edition versions 9.11.3-S1 through 9.16.50-S1 BIND Supported Preview Edition versions 9.18.11-S1 through 9.18.39-S1 BIND Supported Preview Edition versions 9.20.9-S1 through 9.20.13-S1
Description BIND is susceptible to a cache poisoning issue where it improperly handles DNS responses, allowing attackers to inject forged data into the cache. This can lead to redirection of users to malicious sites without their knowledge, potentially enabling phishing attacks, credential theft, and malware distribution. A proof-of-concept exploit is publicly available. Over 706,000 systems and potentially up to 5,900 exposed instances are estimated to be vulnerable. The issue occurs when BIND accepts unsolicited resource records, violating standard DNS security principles. The vulnerability allows off-path attackers to manipulate DNS resolution, potentially redirecting traffic to attacker-controlled infrastructure. The 
forwarders
component is involved in the vulnerability.
Recommendations Upgrade to BIND version 9.18.41 Upgrade to BIND version 9.20.15 Upgrade to BIND version 9.21.14 or later Upgrade to BIND Supported Preview Edition version 9.18.41-S1 Upgrade to BIND Supported Preview Edition version 9.20.15-S1 Restrict recursion to trusted clients Enable DNSSEC validation

Exploit

Fix

DoS

Weakness Enumeration

CWE-349

Related Identifiers

ALT-PU-2025-13412
BDU:2025-13637
CESA-2025_19793
CESA-2025_19835
CVE-2025-40778
RHSA-2025_19793
RHSA-2025_19835
USN-7836-1

Affected Products

Alt Linux
Bind
Centos
Linuxmint
Red Hat
Rocky Linux
Ubuntu