ISC Patches Multiple High-Severity BIND Vulnerabilities Enabling Cache Poisoning and Denial of Service Attacks

The Internet Systems Consortium (ISC) has issued patches for three high-severity BIND 9 vulnerabilities, two of which could enable cache poisoning and one that can cause CPU exhaustion, with all three being remotely exploitable and primarily affecting recursive resolvers while authoritative servers are believed to be unaffected.

The most severe, CVE-2025-40780 (CVSS 8.6), stems from a weakness in BIND’s pseudo-random number generator used to select source ports and query IDs, enabling attackers to predict DNS transaction identifiers and inject malicious responses into a resolver’s cache. A second flaw, CVE-2025-40778 (CVSS 8.6), arises from BIND’s handling of unsolicited resource records in DNS responses, allowing forged data to be injected into the cache during normal queries.

The third vulnerability, CVE-2025-8677 (CVSS 7.5), can cause CPU exhaustion when a resolver queries malformed DNSKEY records, potentially degrading performance or triggering a denial of service. Affected versions include BIND 9.11.0 to 9.16.50, 9.18.0 to 9.18.39, 9.20.0 to 9.20.13, and 9.21.0 to 9.21.12, with fixed releases 9.18.41, 9.20.15, and 9.21.14 (and S1 variants) recommended for each major version.

The advisory notes that resolvers are affected while authoritative services remain unaffected, and upgrading to patched releases is strongly advised. Date: 23 October 2025. according to The Internet Systems Consortium (ISC).