BIND 9 Flaw Lets Attackers Crash Servers With Malicious DNS Records
A critical vulnerability in BIND 9 has been identified, which exposes DNS servers to remote denial-of-service (DoS) attacks. This vulnerability, identified as CVE-2025-13878 , was disclosed on Tue, Jan 21, 2026. It can be triggered by malformed BRID or…
A critical vulnerability in BIND 9 has been identified, which exposes DNS servers to remote denial-of-service (DoS) attacks. This vulnerability, identified as CVE-2025-13878 , was disclosed on Tue, Jan 21, 2026. It can be triggered by malformed BRID or HHIT records in DNS queries, leading to an unexpected termination of the named process.
The vulnerability allows attackers to exploit the flaw without any authentication, posing a significant risk for both authoritative and recursive DNS resolvers. The Internet Systems Consortium (ISC) has released patches to address this issue and advises administrators to update their systems immediately.
Technical Details and Affected Versions
BIND 9, an open-source DNS server developed by ISC, processes DNS resource records to resolve domain names. The vulnerability arises when the server processes malformed BRID (Border Router ID) or HHIT (Host Identity with Hash) records, which are part of experimental extensions not commonly used in production environments.
The flaw results in memory corruption or assertion failures, leading to a server crash. Remote attackers can exploit this by sending crafted DNS packets over UDP or TCP, causing service disruptions. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (High), indicating a severe impact on availability.
Branch Vulnerable Range Patched Version
BIND 9.18 9.18.40 – 9.18.43 9.18.44
BIND 9.20 9.20.13 – 9.20.17 9.20.18
BIND 9.21 9.21.12 – 9.21.16 9.21.17
A critical vulnerability in BIND 9 has been identified, which exposes DNS servers to remote denial-of-service (DoS) attacks.
Supported Preview
9.18.40-S1 – 9.18.43-S1
Administrators are advised to verify their setup using named -V and upgrade via ISC downloads at isc.org/download. There are no workarounds available, as disabling HIP-related features will not mitigate the vulnerability.
Indicators of Compromise and Mitigation
To detect potential attacks or scans, monitor logs for specific crash signatures. Key indicators of compromise include:
Log Patterns : Look for entries like "assertion failure" or "malformed RDATA" in named.run or syslog, followed by "named: premature server shutdown." Network Traffic : Monitor for spikes in UDP/TCP queries to port 53 with anomalous OPT or unknown RR types (BRID=65534, HHIT=65535). Use Wireshark filters: dns.qry.type == 65534 or dns.qry.type == 65535 . Process Indicators : Check for repeated named restarts in ps aux or systemd journals: journalctl -u bind9 | grep 'exited' . Exploit Attempts : Be alert for high-volume queries from single IPs with invalid record lengths >512 bytes in RR sections.
IoC Type Description Detection Tool
Log Regex `. BRID. . HHIT.
Packet Filter dns contains "BRID" or "HHIT" tcpdump -i any port 53
Rate Anomaly
1000 qps from one source
fail2ban or Suricata rules
Implement rate limiting on DNS ports using iptables: iptables -A INPUT -p udp --dport 53 -m limit --limit 100/s -j ACCEPT . Enable DNSSEC validation and Response Rate Limiting (RRL) in named.conf for enhanced protection.
ISC provides a BIND 9 Vulnerability Matrix that tracks issues. Suspicious activity can be reported to ISC. Given that BIND powers a significant portion of global DNS servers, prompt patching is essential to prevent widespread outages.
Based on reporting by GBHackers.