Description
Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.
This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND 9 | 9.18.0 – ≤ 9.18.39, 9.20.0 – ≤ 9.20.13, 9.21.0 – ≤ 9.21.12, 9.18.11-S1 – ≤ 9.18.39-S1, 9.20.9-S1 – ≤ 9.20.13-S1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.20.15-1 | — |
| Debian 13 | bind9 | 1:9.20.15-1~deb13u1 | DSA-6033-1 |
| Debian 12 | bind9 | 1:9.18.41-1~deb12u1 | DSA-6033-1 |
| Debian 11 | bind9 | 1:9.16.50-1~deb11u4 | DLA-4364-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | bind9 | 1:9.20.11-1ubuntu3 | USN-8929-1 |
| Ubuntu 26.04 LTS | isc-dhcp | No fix yet | — |
| Ubuntu 25.10 | bind9 | 1:9.20.11-1ubuntu2.1 | USN-7836-1 |
| Ubuntu 25.10 | isc-dhcp | No fix yet | — |
| Ubuntu 24.04 LTS | bind9 | 1:9.18.39-0ubuntu0.24.04.2 | USN-8929-1, USN-7836-1 |
| Ubuntu 24.04 LTS | isc-dhcp | No fix yet | — |
| Ubuntu 22.04 LTS | bind9 | 1:9.18.39-0ubuntu0.22.04.2 | USN-8929-1, USN-7836-1 |
| Ubuntu 22.04 LTS | bind9-libs | No fix yet | — |
| Ubuntu 20.04 LTS | bind9-libs | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | isc-dhcp | No fix yet | — |
| Ubuntu Pro 20.04 LTS | bind9 | 1:9.18.30-0ubuntu0.20.04.2+esm1 | USN-8929-1, USN-7836-2 |
| Ubuntu Pro 18.04 LTS | bind9 | 1:9.11.3+dfsg-1ubuntu1.19+esm6 | USN-8929-1 |
| Ubuntu Pro 16.04 LTS | bind9 | 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11 | USN-8929-1 |
| Ubuntu Pro 14.04 LTS | bind9 | 1:9.9.5.dfsg-3ubuntu0.19+esm15 | USN-8929-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | bind +7 | 32:9.18.33-4.el10_0.2 | RHSA-2025:21034, RHSA-2025:19912 |
| RHEL 9 | bind +9 | 32:9.16.23-40.el9_8.1 | RHSA-2026:18786 |
| RHEL 9 | bind9.18 +6 | 32:9.18.29-4.el9_6.2 | RHSA-2025:21111, RHSA-2025:19950 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | bind +6 | 9.18.48-1.hum1 | RHSA-2026:6935 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | bind +5 | 32:9.18.33-10.el10_1.2 | ALSA-2025:21034 |
| AlmaLinux 10 | bind-doc +1 | 32:9.18.33-4.el10_0.2 | ALSA-2025:21034, ALSA-2025:19912 |
| AlmaLinux 9 | bind +9 | 32:9.16.23-40.el9_8.1 | ALSA-2026:18786 |
| AlmaLinux 9 | bind9.18 +6 | 32:9.18.29-4.el9_6.2 | ALSA-2025:21111, ALSA-2025:19950 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | bind | 2:9.18.33-10.el10_1.2 | RLSA-2025:21034 |
| Rocky Linux 9 | bind | 2:9.16.23-40.el9_8.1 | RLSA-2026:18786 |
| Rocky Linux 9 | bind9.18 | 2:9.18.29-5.el9_7.2 | RLSA-2025:21111 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | bind | 9.20.15-150700.3.12.1 | SUSE-SU-2025:3903-1 |
| SLES 15 SP6 | bind | 9.18.33-150600.3.18.1 | SUSE-SU-2025:4110-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | bind | 9.20.15-160000.1.1 | SUSE-SU-2026:20085-1 |
| SLES 16.0 | bind | 9.20.15-160000.1.1 | SUSE-SU-2026:20085-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.20.15-1.1 | openSUSE-SU-2025:15659-1 |
| openSUSE Leap 16.0 | bind | 9.20.15-160000.1.1 | openSUSE-SU-2026:20039-1 |
| openSUSE Leap 15.6 | bind | 9.18.33-150600.3.18.1 | SUSE-SU-2025:4110-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | bind | 9.20.15-r0 | — |
| Alpine v3.23 | bind | 9.20.15-r0 | — |
| Alpine v3.22 | bind | 9.20.15-r0 | — |
| Alpine v3.21 | bind | 9.18.41-r0 | — |
| Alpine v3.20 | bind | 9.18.41-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | bind | 9.18.41-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | bind +7 | 32:9.18.33-1.amzn2023.0.4 | ALAS2023-2025-1255 |
| Amazon Linux 2 | bind +15 | 32:9.11.4-26.P2.amzn2.13.12 | ALAS2-2025-3054 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | bind | 9.20.15-1 | — |
| Azure Linux 2 (CBL-Mariner) | bind | 9.16.50-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | bind +7 | 32:9.18.33-4.0.1.el10_0.2 | ELSA-2025-21034, ELSA-2025-19912 |
| Oracle Linux 9 | bind +9 | 32:9.16.23-40.0.1.el9_8.1 | ELSA-2026-18786 |
| Oracle Linux 9 | bind9.18 +6 | 32:9.18.29-4.el9_6.2 | ELSA-2025-21111, ELSA-2025-19950 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | bind +5 | 9.20.16-r0 | — |
| Wolfi rolling | bind-dev | 9.20.15-r0 | — |
Advisories 33
- ALSA-2025:21034 Important: bind security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:18786 Important: bind security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21111 Important: bind9.18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19950 Important: bind9.18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19912 Important: bind security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8929-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- WID-SEC-2025-2392 Internet Systems Consortium BIND: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2026
- RHSA-2026:6935 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:21111 Red Hat Security Advisory: bind9.18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:21034 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:19912 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:19950 Red Hat Security Advisory: bind9.18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:18786 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- ELSA-2026-18786 Important: bind security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 12, 2026
- RLSA-2026:18786 Important: bind security update Rocky Linux Security Advisories · May 28, 2026
- USN-7836-2 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-7836-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2026:20039-1 Security update for bind SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15659-1 bind-9.20.15-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20085-1 Security update for bind SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:3903-1 Security update for bind SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4110-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2025-21034 Important: bind security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 2, 2025
- ELSA-2025-21111 Important: bind9.18 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:21111 Important: bind9.18 security update Rocky Linux Security Advisories · Nov 21, 2025
- RLSA-2025:21034 Important: bind security update Rocky Linux Security Advisories · Nov 21, 2025
- ELSA-2025-19950 Important: bind9.18 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 10, 2025
- ELSA-2025-19912 Important: bind security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 6, 2025
- ALAS2-2025-3054 Important: bind security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 5, 2025
- ALAS2023-2025-1255 Important: bind security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 5, 2025
- DLA-4364-1 bind9 - security update Debian Security (DSA / DLA) · Nov 4, 2025
- NCSC-2025-0341 Kwetsbaarheden verholpen in BIND 9 NCSC-NL (Netherlands) · Oct 27, 2025
- DSA-6033-1 bind9 - security update Debian Security (DSA / DLA) · Oct 23, 2025
References
- CVE-2025-8677 vendor-advisory