BIND warns of bugs that could bring DNS cache attack back from the dead

The makers of BIND warn of two vulnerabilities that could let attackers poison caches of DNS results and steer users to malicious sites, with CVE-2025-40778 and CVE-2025-40780 each carrying a severity of 8.6. Patches for all three issues—two in BIND and a related vulnerability in Unbound (CVE-2025-11411) with a severity of 5.6) were made available on Wednesday, 22 October 2025.

The flaws stem from a logic error and a weakness in generating pseudo-random numbers, and in certain circumstances could allow resolvers to accept forged data or to cache attacker responses. Red Hat notes that while exploitation is non-trivial and to a limited extent affects only cache integrity, the vulnerability is considered Important rather than Critical, thanks to countermeasures such as DNSSEC, rate limiting, and server firewalls.

If exploited, thousands of DNS resolvers could be coaxed to replace legitimate results with malicious ones, though authoritative servers remain unaffected. According to Red Hat, the overall impact would be modest, but organisations are urged to apply patches promptly.