Critical Security Update for BIND: Cache Poisoning Vulnerability
Summary
ALSA-2025:19835: Important: bind security update. Affects bind versions < 32:9.11.36-16.el8_10.6. Fixed in 32:9.11.36-16.el8_10.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is essential for translating domain names into IP addresses, making it a cornerstone of internet functionality. However, vulnerabilities in BIND can lead to severe security risks, including cache poisoning attacks, which can compromise the integrity of DNS responses.
Vulnerability Detail
The vulnerability identified as CVE-2025-40778 allows for cache poisoning attacks through unsolicited Resource Records (RRs). This means that an attacker can potentially inject false DNS responses into the cache of a DNS server, leading to users being redirected to malicious sites. The implications of this vulnerability are significant, as it can undermine the trustworthiness of DNS, allowing attackers to intercept sensitive information or redirect traffic.
How To Fix
Minimum fixed version
32:9.11.36-16.el8_10.6
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your DNS server to minimize the risk of cache poisoning by implementing DNSSEC (Domain Name System Security Extensions) to ensure the authenticity of DNS responses. However, this is not a complete fix and should not replace the necessary updates.
Conclusion
The BIND vulnerability CVE-2025-40778 poses a significant risk through cache poisoning attacks. It is essential to update to the patched version to protect your systems. Implementing temporary workarounds like DNSSEC can help mitigate risks until the update is applied.
See every vulnerability recorded for bind →
FAQ
The vulnerability allows for cache poisoning attacks, where an attacker can inject false DNS responses into the cache of a DNS server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can lead to users being redirected to malicious sites, compromising sensitive information and undermining trust in DNS.
Yes, a patch is available in version 32:9.11.36-16.el8_10.6. It is recommended to update to this version.
If you cannot apply the patch immediately, consider implementing DNSSEC as a temporary workaround to mitigate the risk of cache poisoning.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
