Skip to content
OpenAdvisories
High ELSA-2025-22205 1 CVE

Important: bind security update (Oracle Linux 7)

Published Jan 6, 2026 · Updated Jan 6, 2026

Summary

[32:9.11.4-26.0.5.P2.16]
- Resolve CVE-2025-40778 [Orabug: 38699863]

[32:9.11.4-26.0.3.P2.16]
- Resolve CVE-2024-11187 [Orabug: 37616907]

[32:9.11.4-26.0.1.P2.16]
- Resolve CVE-2024-1975
- Resolve CVE-2024-1737
- Add ability to change runtime limits for max types and records per name

[32:9.11.4-26.P2.16]
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
CVE-2023-50868)
- Add missing design by contract tests to dns_catz*
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
- Do not use header_prev in expire_lru_headers

[32:9.11.4-26.P2.15]
- Limit the amount of recursion possible in control channel (CVE-2023-3341)

[32:9.11.4-26.P2.14]
- Prevent the cache going over the configured limit (CVE-2023-2828)

[32:9.11.4-26.P2.13]
- Tighten cache protection against record from forwarders (CVE-2021-25220)

[32:9.11.4-26.P2.12]
- Include test of forwarders (CVE-2021-25220)

[32:9.11.4-26.P2.11]
- Prevent excessive resource use while processing large delegations.
(CVE-2022-2795)

[32:9.11.4-26.P2.10]
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)

Fixed packages 16

ReleasePackageFixed in
Oracle Linux · 7 bind 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-chroot 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-devel 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-export-devel 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-export-libs 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-libs 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-libs-lite 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-license 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-lite-devel 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-pkcs11 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-pkcs11-devel 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-pkcs11-libs 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-pkcs11-utils 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-sdb 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-sdb-chroot 32:9.11.4-26.0.5.P2.el7_9.16
Oracle Linux · 7 bind-utils 32:9.11.4-26.0.5.P2.el7_9.16

Vulnerabilities 1

  • High 8.6
    CVE-2025-40778 Public exploit

    Cache poisoning attacks with unsolicited RRs

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …