Critical Security Update for BIND 9.18: Addressing Cache Poisoning and Resource Exhaustion Vulnerabilities
Summary
ALSA-2025:19950: Important: bind9.18 security update. Affects bind9.18 versions < 32:9.18.29-4.el9_6.2. Fixed in 32:9.18.29-4.el9_6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the DNS (Domain Name System) protocols. It includes a DNS server (named) that resolves host names to IP addresses, a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is critical for internet functionality, making its security paramount.
Vulnerability Detail
The vulnerabilities in BIND 9.18 include cache poisoning attacks due to unsolicited resource records (CVE-2025-40778), cache poisoning stemming from a weak pseudo-random number generator (CVE-2025-40780), and resource exhaustion caused by malformed DNSKEY handling (CVE-2025-8677). These vulnerabilities can lead to unauthorized access, denial of service, and manipulation of DNS responses, posing significant risks to network integrity and security.
How To Fix
Minimum fixed version
32:9.18.29-4.el9_6.2
This is the first release that contains the fix.
sudo dnf update bind9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the DNS server to trusted IP addresses only, and implement rate limiting to mitigate the impact of potential attacks until the update is applied.
Conclusion
The vulnerabilities in BIND 9.18 pose significant risks to network security, necessitating immediate action to update to the patched version. By following the outlined steps to fix the vulnerabilities and implementing recommended workarounds, users can protect their systems from potential attacks.
See every vulnerability recorded for bind9.18 →
FAQ
BIND is an implementation of the DNS protocols, providing a DNS server and resolver library for applications.
The main vulnerabilities include cache poisoning attacks and resource exhaustion due to malformed DNSKEY handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
These vulnerabilities can lead to unauthorized access, denial of service, and manipulation of DNS responses, compromising network security.
It is recommended to regularly check for updates and apply them promptly to ensure the security and stability of your DNS services.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.18.
