Skip to content
OpenAdvisories
High ALSA-2025:21111 3 CVEs

Important: bind9.18 security update

Published Nov 12, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Security Fix(es):

* bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778)
* bind: Cache poisoning due to weak PRNG (CVE-2025-40780)
* bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 7

ReleasePackageFixed in
AlmaLinux · 9 bind9.18 32:9.18.29-5.el9_7.2
AlmaLinux · 9 bind9.18-chroot 32:9.18.29-5.el9_7.2
AlmaLinux · 9 bind9.18-devel 32:9.18.29-5.el9_7.2
AlmaLinux · 9 bind9.18-dnssec-utils 32:9.18.29-5.el9_7.2
AlmaLinux · 9 bind9.18-doc 32:9.18.29-5.el9_7.2
AlmaLinux · 9 bind9.18-libs 32:9.18.29-5.el9_7.2
AlmaLinux · 9 bind9.18-utils 32:9.18.29-5.el9_7.2

Vulnerabilities 3

  • High 8.6
    CVE-2025-40778 Public exploit

    Cache poisoning attacks with unsolicited RRs

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.6
    CVE-2025-40780

    Cache poisoning due to weak PRNG

    In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-8677 EPSS 11%

    Resource exhaustion via malformed DNSKEY handling

    Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-40778
  • report
    https://access.redhat.com/security/cve/CVE-2025-40780
  • report
    https://access.redhat.com/security/cve/CVE-2025-8677
  • report
    https://bugzilla.redhat.com/2405827
  • report
    https://bugzilla.redhat.com/2405829
  • report
    https://bugzilla.redhat.com/2405830
  • advisory
    https://errata.almalinux.org/9/ALSA-2025-21111.html