Red Hat Security Advisory: bind security update

Fixed packages 76

Vulnerabilities 2

• High 8.6
  CVE-2025-40778 Public exploit

  Cache poisoning attacks with unsolicited RRs

  Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …

  ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 22, 2025
• Medium 6.8
  CVE-2021-25220

  DNS forwarders - cache poisoning vulnerability

  BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to…

  ISC BIND bind9 bind9 Debian Ubuntu Azure Linux Alpine
  Mar 23, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064512
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2405827
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21740.json
• report
  https://access.redhat.com/security/cve/CVE-2021-25220
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-25220
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-25220
• article
  https://kb.isc.org/docs/CVE-2021-25220
• report
  https://access.redhat.com/security/cve/CVE-2025-40778
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40778
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40778