706,000+ BIND 9 DNS Resolvers Exposed to Cache Poisoning – PoC Released

A critical vulnerability affecting more than 706,000 BIND 9 DNS resolvers worldwide has been disclosed, with proof-of-concept exploit code now publicly available. The flaw enables cache poisoning by allowing forged DNS records to be injected into vulnerable resolver caches, potentially redirecting users to attacker-controlled infrastructure. The vulnerability, tracked as CVE-2025-40778, was disclosed by the Internet Systems Consortium on 22 October 2025, with a CVSS score of 8.6.

Security researchers at Censys identified 706,477 vulnerable instances exposed on the internet at disclosure, underscoring the risk of widespread exploitation. The issue lies in how BIND 9 resolvers process DNS responses and affects multiple version branches, including 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, and 9.21.0 through 9.21.12; patched versions released by ISC are 9.18.41, 9.20.15, and 9.21.14.

A GitHub proof-of-concept has been published, and while no active exploitation was reported at disclosure, the available exploit code heightens risk, prompting recommendations to upgrade and apply mitigations such as restricting recursion to trusted clients and enabling DNSSEC validation.