Critical Assertion Failure in BIND Package Due to CNAME Chain Handling
Summary
ALPINE-CVE-2025-40777: If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a quer... Affects bind versions < 9.20.11-r0. Fixed in 9.20.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used DNS server software that provides a variety of DNS services, including caching and authoritative DNS. It is known for its reliability, flexibility, and extensive feature set, making it a popular choice for both small and large organizations. However, certain configurations can expose it to vulnerabilities, such as the one described here, which can lead to service disruptions.
Vulnerability Detail
The vulnerability arises when a named caching resolver is configured with serve-stale-enable set to yes and stale-answer-client-timeout set to 0. Under these conditions, if the resolver encounters a specific combination of cached or authoritative records while resolving a query involving a CNAME chain, it will trigger an assertion failure, causing the daemon to abort. This issue affects BIND versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1, potentially leading to denial of service.
How To Fix
Minimum fixed version
9.20.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the serve-stale-enable option or set stale-answer-client-timeout to a value other than 0 to prevent the assertion failure until the package can be updated.
Conclusion
In summary, the identified vulnerability in the BIND package can lead to significant service disruptions if not addressed. It is crucial to update to the patched version or implement the suggested workaround to mitigate the risks associated with this issue.
See every vulnerability recorded for bind →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
BIND versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1 are affected by this vulnerability.
If left unaddressed, this vulnerability can lead to a denial of service, causing the DNS service to become unavailable.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind.
