PT-2025-43373 · Isc+10 · Bind+10
Published
2025-10-22
·
Updated
2026-02-18
·
CVE-2025-40780
CVSS v3.1
8.6
High
| AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
BIND versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Description
Due to a weakness in the Pseudo Random Number Generator (PRNG) used by BIND, an attacker can predict the source port and query ID. This can lead to cache poisoning, where malicious DNS responses are injected into the resolver’s cache, potentially causing clients to be redirected to incorrect websites. The vulnerability affects recursive resolvers, while authoritative servers are not impacted. The attack can be performed remotely without user interaction.
Recommendations
Upgrade BIND to a version prior to 9.16.0, or after 9.16.50, 9.18.39, 9.20.13, 9.21.12, 9.16.50-S1, 9.18.39-S1, and 9.20.13-S1.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Bind
Centos
Ibm Aix
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu