Critical Security Update for BIND: Addressing Cache Poisoning and Resource Exhaustion Vulnerabilities
Summary
ALSA-2025:19912: Important: bind security update. Affects bind versions < 32:9.18.33-4.el10_0.2. Fixed in 32:9.18.33-4.el10_0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is essential for translating human-readable domain names into IP addresses, making it a cornerstone of internet functionality. However, vulnerabilities in BIND can lead to severe security risks, including cache poisoning and resource exhaustion.
Vulnerability Detail
This vulnerability arises from multiple security flaws in BIND, specifically: cache poisoning attacks via unsolicited resource records (CVE-2025-40778), cache poisoning due to weak pseudo-random number generation (CVE-2025-40780), and resource exhaustion caused by malformed DNSKEY handling (CVE-2025-8677). These vulnerabilities can allow attackers to manipulate DNS responses, leading to potential data breaches or service disruptions.
How To Fix
Minimum fixed version
32:9.18.33-4.el10_0.2
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing DNSSEC (Domain Name System Security Extensions) to help protect against cache poisoning attacks. Additionally, restrict access to the DNS server to trusted IP addresses only.
Conclusion
The vulnerabilities in BIND pose significant risks to DNS operations, making it crucial for users to update their installations promptly. By following the provided steps to update and implementing suggested workarounds, users can mitigate potential threats effectively.
See every vulnerability recorded for bind →
FAQ
BIND is a software suite that implements the Domain Name System (DNS) protocols, providing essential services for domain name resolution.
The vulnerabilities can lead to cache poisoning, allowing attackers to redirect traffic or exhaust server resources, potentially causing service outages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement workarounds such as restricting access to the DNS server and using DNSSEC to mitigate risks.
Detailed information about the vulnerabilities can be found on the CVE pages: CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
