Critical Assertion Failure in BIND Due to Invalid TSIG Algorithm
Summary
ALPINE-CVE-2025-40775: When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. Affects bind versions < 9.18.37-r0. Fixed in 9.18.37-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a range of DNS services, including authoritative DNS and DNS resolution. It is known for its robustness and flexibility, making it a popular choice for managing DNS records. However, certain versions of BIND are vulnerable to an assertion failure when processing DNS messages with invalid Transaction Signature (TSIG) algorithm fields, potentially leading to service disruptions.
Vulnerability Detail
The vulnerability arises when BIND processes an incoming DNS protocol message containing a TSIG. If the TSIG has an invalid value in the algorithm field, BIND triggers an assertion failure, causing the server to abort unexpectedly. This issue affects BIND versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7, leading to potential denial of service (DoS) conditions for users relying on the affected DNS services.
How To Fix
Minimum fixed version
9.18.37-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict validation of incoming DNS messages and filtering out any messages with invalid TSIG fields. However, this may not be a complete solution and should not replace the need for an update.
Conclusion
The assertion failure vulnerability in BIND due to invalid TSIG algorithm fields poses a significant risk to DNS services. It is crucial to update to the patched versions to mitigate potential denial of service attacks. Users are encouraged to monitor their systems and apply the necessary updates promptly.
See every vulnerability recorded for bind →
FAQ
BIND is a DNS server software that provides DNS services, including name resolution and authoritative DNS.
TSIG stands for Transaction Signature, which is used to secure DNS messages.
If your BIND server is running a vulnerable version, it may crash when processing certain DNS messages, leading to service outages.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
If an immediate update is not possible, implement strict validation of incoming DNS messages as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
