Multiple BIND 9 DNS Vulnerabilities Enable Cache Poisoning and Denial Of Service Attacks
On Wed, Oct 22, 2025, the Internet Systems Consortium (ISC) announced the discovery of three high-severity vulnerabilities in BIND 9. These vulnerabilities may allow remote attackers to execute cache poisoning attacks or cause denial-of-service (DoS)…
On Wed, Oct 22, 2025, the Internet Systems Consortium (ISC) announced the discovery of three high-severity vulnerabilities in BIND 9. These vulnerabilities may allow remote attackers to execute cache poisoning attacks or cause denial-of-service (DoS) conditions on affected DNS resolvers.
The vulnerabilities, identified as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780, primarily affect recursive resolvers used by organizations for domain name resolution. Authoritative DNS servers remain largely unaffected.
BIND, which supports a significant portion of the internet's DNS infrastructure, requires immediate patching by administrators to prevent service disruptions and malicious redirections.
CVE-2025-8677 involves resource exhaustion caused by malformed DNSKEY records in specially crafted zones, leading to CPU overload on resolvers during queries. This vulnerability, with a CVSS score of 7.5, allows attackers to remotely overwhelm servers without authentication, significantly degrading performance for legitimate users.
The other two vulnerabilities relate to cache poisoning:
On Wed, Oct 22, 2025, the Internet Systems Consortium (ISC) announced the discovery of three high-severity vulnerabilities in BIND 9.
CVE-2025-40778 (CVSS 8.6) involves BIND's permissive handling of unsolicited resource records, enabling forged data to infiltrate the cache. CVE-2025-40780 (CVSS 8.6) exploits a weak pseudo-random number generator (PRNG), making source ports and query IDs predictable for spoofing.
Both vulnerabilities increase the attack surface, allowing tainted caches to redirect traffic across networks.
Researchers from Nankai University, Tsinghua University, and Hebrew University of Jerusalem identified these issues. While no active exploits are currently known, the remote and unauthenticated nature of these vulnerabilities heightens urgency due to BIND's widespread deployment.
Successful exploitation could lead to phishing, malware distribution, or man-in-the-middle attacks by redirecting users to malicious sites. The DoS risk from CVE-2025-8677 poses operational downtime, financial losses, and reduced productivity for businesses reliant on stable DNS. Organizations using vulnerable BIND versions 9.11.0 to 9.21.12 and Supported Preview Editions face increased threats, particularly in cloud and enterprise environments.
ISC highlights the ongoing challenges in DNS resilience, even after mitigations like randomized query IDs. Distributions such as Ubuntu and Red Hat have begun issuing updates, and package maintainers are encouraged to release patches promptly.
No workarounds are available, making it essential to upgrade to fixed releases: BIND 9.18.41, 9.20.15, or 9.21.14 for standard branches, and corresponding Supported Preview versions. Selective patches are available in release directories for minimal changes. Administrators are advised to review ISC's advisories and monitor distribution updates to protect against these DNS threats.
Based on reporting by Cyber Security News.