Skip to content
OpenAdvisories
High DSA-6033-1 3 CVEs

bind9 - security update

Published Oct 23, 2025 · Updated Oct 23, 2025

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 12 bind9 1:9.18.41-1~deb12u1
Debian · 13 bind9 1:9.20.15-1~deb13u1

Vulnerabilities 3

  • High 8.6
    CVE-2025-40778 Public exploit

    Cache poisoning attacks with unsolicited RRs

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.6
    CVE-2025-40780

    Cache poisoning due to weak PRNG

    In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2025-8677 EPSS 11%

    Resource exhaustion via malformed DNSKEY handling

    Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi