Critical Assertion Failure in BIND Package Due to CNAME Chain Handling
Summary
CVE-2025-40777: If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a quer... Affects bind versions < 9.20.11-r0. Fixed in 9.20.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides name resolution services for the internet. It is known for its robustness and flexibility, allowing administrators to configure various DNS features. However, certain configurations can lead to vulnerabilities, such as the one described here, which affects BIND versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1. This vulnerability arises when specific settings are enabled, potentially leading to service disruptions.
Vulnerability Detail
The vulnerability occurs when a 'named' caching resolver is configured with 'serve-stale-enable' set to 'yes' and 'stale-answer-client-timeout' set to '0'. Under these conditions, if the resolver encounters a CNAME chain involving a specific combination of cached or authoritative records while resolving a query, it will abort with an assertion failure. This can lead to denial of service, as the DNS service will become unresponsive, affecting all clients relying on it.
How To Fix
Minimum fixed version
9.20.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the 'serve-stale-enable' option or setting 'stale-answer-client-timeout' to 'disabled' to prevent the assertion failure until the package can be updated.
Conclusion
In summary, the vulnerability in BIND related to CNAME chain handling can lead to significant service disruptions. It is crucial to update to the patched version or implement the suggested workarounds to mitigate the risk. Regular monitoring of vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for bind →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
BIND versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1 are affected by this vulnerability.
If left unaddressed, this vulnerability can lead to denial of service, causing the DNS service to become unresponsive.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, Vulert allows you to monitor vulnerabilities using a manifest file like package-lock.json, providing real-time alerts.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
