Summary
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | bind | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-chroot | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-devel | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-dnssec-doc | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-dnssec-utils | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-doc | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-libs | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-license | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | bind-utils | 32:9.16.23-40.el9_8.1 |
| AlmaLinux · 9 | python3-bind | 32:9.16.23-40.el9_8.1 |
Vulnerabilities 1
-
High 7.5CVE-2025-8677 EPSS 11%
Resource exhaustion via malformed DNSKEY handling
Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-…