PT-2025-43379 · Isc+10 · Bind+10

Published 2025-10-22 · Updated 2026-02-18 · CVE-2025-8677

Positive Technologies · (AI Summary)

CVSS v2.0

7.8

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions BIND versions 9.18.0 through 9.18.39 BIND versions 9.20.0 through 9.20.13 BIND versions 9.21.0 through 9.21.12 BIND versions 9.18.11-S1 through 9.18.39-S1 BIND versions 9.20.9-S1 through 9.20.13-S1

Description Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.

Recommendations Update BIND to a version later than 9.18.39. Update BIND to a version later than 9.20.13. Update BIND to a version later than 9.21.12. Update BIND to a version later than 9.18.39-S1. Update BIND to a version later than 9.20.13-S1.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-405

Related Identifiers

ALSA-2025:19912

ALSA-2025:19950

ALSA-2025:21034

ALSA-2025:21111

ALT-PU-2025-13369

BDU:2025-14392

CESA-2025_19835

CVE-2025-8677

DLA-4364-1

DSA-6033-1

INFSA-2025_21111

MGASA-2025-0254

OESA-2025-2654

RHSA-2025:19912

RHSA-2025:19950

RHSA-2025:21034

RHSA-2025:21111

RHSA-2025_19835

RHSA-2025_19950

RHSA-2025_21111

SUSE-SU-2025:4110-1

USN-7836-1

USN-7836-2

Affected Products

Alt Linux

Almalinux

Bind

Centos

Ibm Aix

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 73

• https://nvd.nist.gov/vuln/detail/CVE-2025-40780 · Security Note
• https://osv.dev/vulnerability/ALSA-2025:21111 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:21111 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0254 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4364-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2654 · Vendor Advisory
• https://kb.isc.org/docs/cve-2025-8677 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40780 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-8677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8677 · Security Note
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-8677 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6033-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7836-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-8677 · Security Note