Critical Assertion Failure in BIND Due to Invalid TSIG Algorithm
Summary
CVE-2025-40775: When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. Affects bind versions < 9.18.37-r0. Fixed in 9.18.37-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a robust and flexible platform for managing DNS services. It is essential for translating human-readable domain names into IP addresses, enabling users to access websites and services on the internet. BIND is known for its reliability and extensive feature set, but it is also susceptible to vulnerabilities that can compromise its security and functionality. This specific vulnerability affects multiple versions of BIND, making it crucial for users to stay informed and updated.
Vulnerability Detail
The vulnerability arises when an incoming DNS protocol message includes a Transaction Signature (TSIG) with an invalid value in the algorithm field. In such cases, BIND fails with an assertion error, leading to a potential denial of service. This issue affects BIND versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7, posing a risk to systems relying on these versions for DNS services. Attackers could exploit this vulnerability to disrupt DNS operations, impacting the availability of services and potentially leading to further security issues.
How To Fix
Minimum fixed version
9.18.37-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement strict validation of incoming TSIG messages to mitigate the risk of assertion failures. However, this is not a permanent solution and should not replace updating to the patched version.
Conclusion
The vulnerability CVE-2025-40775 in BIND poses a significant risk due to assertion failures triggered by invalid TSIG algorithm values. Users are strongly advised to update to the patched version to ensure the security and reliability of their DNS services. Regular monitoring and updates are essential to mitigate such vulnerabilities.
See every vulnerability recorded for bind →
FAQ
BIND is a DNS server software that translates domain names into IP addresses, allowing users to access websites and services.
TSIG stands for Transaction Signature, which is used to provide a secure method for authenticating DNS messages.
Exploiting this vulnerability can lead to a denial of service, disrupting DNS operations and affecting the availability of services.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. You can check your application for this vulnerability at Vulert Scanner without signing up.
If immediate updates are not possible, consider implementing strict validation of incoming TSIG messages as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
