BIND 9 Vulnerabilities Expose DNS Servers to Cache Poisoning and DoS

On October 22, 2025, the Internet Systems Consortium (ISC) disclosed three critical vulnerabilities in BIND 9, a widely used DNS software. These vulnerabilities, which affect DNS resolvers, could lead to cache poisoning and denial-of-service (DoS) attacks, impacting millions of users globally. The vulnerabilities are classified with CVSS scores of 8.6 (critical) and 7.5 (high), requiring network-based remote exploitation without authentication.

Organizations are urged to patch their systems immediately to prevent exploitation. The vulnerabilities include: 1. CVE-2025-8677: Resource exhaustion via malformed DNSKEY handling (CVSS 7.5). 2. CVE-2025-40778: Cache poisoning with unsolicited RRs (CVSS 8.6). 3. CVE-2025-40780: Cache poisoning due to weak PRNG (CVSS 8.6). Patching is the only mitigation strategy as no known exploits or workarounds exist.