Critical Security Flaw in BIND Package: Cache Poisoning Vulnerabilities
Summary
ALSA-2025:21110: Important: bind security update. Affects bind versions < 32:9.16.23-34.el9_7.1. Fixed in 32:9.16.23-34.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols, which includes a DNS server (named), a resolver library for applications, and tools for verifying DNS server functionality. BIND is essential for translating domain names into IP addresses, making it a critical component of internet infrastructure. However, recent vulnerabilities have been identified that could compromise its security.
Vulnerability Detail
The vulnerabilities identified in BIND include cache poisoning attacks due to unsolicited Resource Records (RRs) (CVE-2025-40778) and cache poisoning resulting from a weak Pseudo-Random Number Generator (PRNG) (CVE-2025-40780). These vulnerabilities can allow attackers to manipulate DNS responses, potentially redirecting users to malicious sites or intercepting sensitive data. The weaknesses stem from flaws in how BIND processes DNS queries and responses, making it susceptible to exploitation if not addressed.
How To Fix
Minimum fixed version
32:9.16.23-34.el9_7.1
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement DNSSEC (Domain Name System Security Extensions) to help mitigate the risks associated with cache poisoning. However, this is not a complete solution and should not replace updating to the patched version.
Conclusion
The identified vulnerabilities in the BIND package pose significant risks to DNS security, allowing for potential cache poisoning attacks. It is crucial for users to update to the latest patched version to safeguard their systems. Implementing temporary workarounds like DNSSEC can help mitigate risks until updates are applied.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the DNS protocols that allows for the translation of domain names into IP addresses, essential for internet functionality.
Cache poisoning attacks involve injecting false DNS responses into a DNS resolver's cache, leading to incorrect domain name resolutions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing DNSSEC as a temporary workaround to reduce the risk of cache poisoning.
For more details, refer to the CVE pages for CVE-2025-40778 and CVE-2025-40780, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
