Skip to content
OpenAdvisories
High RHSA-2025:21939 2 CVEs

Red Hat Security Advisory: bind9.16 security update

Published Nov 25, 2025 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 24

ReleasePackageFixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-chroot 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-debugsource 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-dnssec-utils 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-dnssec-utils-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-libs 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-libs-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-license 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-utils 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream bind9.16-utils-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream python3-bind9.16 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-chroot 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-debugsource 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-dnssec-utils 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-dnssec-utils-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-libs 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-libs-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-license 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-utils 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream bind9.16-utils-debuginfo 32:9.16.23-0.14.el8_8.7
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream python3-bind9.16 32:9.16.23-0.14.el8_8.7

Vulnerabilities 2

  • High 8.6
    CVE-2025-40778 Public exploit

    Cache poisoning attacks with unsolicited RRs

    Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.6
    CVE-2025-40780

    Cache poisoning due to weak PRNG

    In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2405827
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2405829
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21939.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-40778
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40778
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40778
  • report
    https://access.redhat.com/security/cve/CVE-2025-40780
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40780
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40780