BIND Updates Address High-Severity Cache Poisoning Flaws

The Internet Systems Consortium (ISC) has released BIND 9 updates to fix three high-severity vulnerabilities that could enable cache poisoning. The flaws include a PRNG weakness that could let an attacker predict the source port and query ID used by BIND, enabling spoofing attacks tracked as CVE-2025-40780 (CVSS 8.6). A second bug, CVE-2025-40778 (CVSS 8.6), arises because BIND can be too lenient when accepting records from answers, allowing forged records to be injected into the cache.

The third issue, CVE-2025-8677 (CVSS 7.5), is a DoS flaw triggered by querying for records in a specially crafted zone containing certain malformed DNSKEY records, potentially exhausting CPU resources. According to ISC, all three flaws affect resolvers but not authoritative servers, and there is no workaround. They have been addressed in BIND versions 9.18.41, 9.20.15, and 9.21.14, plus the corresponding Preview Edition releases, with ISC urging updating to a patched version as soon as possible.