Critical Resource Exhaustion Vulnerability in BIND Package
Summary
ALSA-2026:18786: Important: bind security update. Affects bind versions < 32:9.16.23-40.el9_8.1. Fixed in 32:9.16.23-40.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications, and various tools for DNS server verification. BIND is crucial for translating domain names into IP addresses, making it a fundamental component of internet infrastructure. The recent vulnerability affects BIND's ability to handle malformed DNSKEY records, leading to potential resource exhaustion.
Vulnerability Detail
The vulnerability, identified as CVE-2025-8677, arises from improper handling of malformed DNSKEY records in BIND. This flaw can lead to resource exhaustion, where the DNS server becomes overwhelmed and unable to process legitimate requests. Attackers can exploit this vulnerability to disrupt DNS services, potentially causing denial-of-service conditions. The severity of this issue necessitates immediate attention from system administrators and users of BIND.
How To Fix
Minimum fixed version
32:9.16.23-40.el9_8.1
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on DNS queries to mitigate the impact of potential exploitation until the package can be updated. This can help reduce the load on the DNS server.
Conclusion
The resource exhaustion vulnerability in the BIND package poses a significant risk to DNS services. It is crucial for users and administrators to update their installations to the patched version to ensure continued security and functionality. Implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for bind →
FAQ
CVE-2025-8677 can lead to resource exhaustion, causing the DNS server to become unresponsive and potentially resulting in denial-of-service conditions.
You can check your BIND version using the command named -v. If it is below the patched version 32:9.16.23-40.el9_8.1, it is vulnerable.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities at Vulert Scanner.
If an immediate update is not possible, implement rate limiting on DNS queries to help mitigate the risk of exploitation.
For more details, refer to the CVE page for CVE-2025-8677 and the AlmaLinux Release Notes linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
