Critical Security Update for BIND Package: Cache Poisoning and Resource Exhaustion Vulnerabilities
Summary
ALSA-2025:21034: Important: bind security update. Affects bind versions < 32:9.18.33-10.el10_1.2. Fixed in 32:9.18.33-10.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Berkeley Internet Name Domain (BIND) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library for applications interfacing with DNS, and various tools for verifying DNS server operations. BIND is crucial for translating domain names into IP addresses, making it a fundamental component of internet infrastructure. However, recent vulnerabilities have been identified that could compromise its security and functionality.
Vulnerability Detail
The vulnerabilities in BIND include cache poisoning attacks due to unsolicited Resource Records (CVE-2025-40778), cache poisoning stemming from a weak Pseudo-Random Number Generator (CVE-2025-40780), and resource exhaustion caused by malformed DNSKEY handling (CVE-2025-8677). These vulnerabilities can lead to unauthorized access, denial of service, and manipulation of DNS responses, severely impacting the integrity and availability of DNS services.
How To Fix
Minimum fixed version
32:9.18.33-10.el10_1.2
This is the first release that contains the fix.
sudo dnf update bindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the DNS server by configuring firewall rules to restrict incoming connections. Additionally, disabling features that are not in use can help mitigate potential attack vectors until the package is updated.
Conclusion
The identified vulnerabilities in the BIND package pose significant risks to DNS services. It is crucial for users to update to the latest patched version to mitigate these risks. Regular monitoring and proactive security measures are essential to maintain the integrity of DNS operations.
See every vulnerability recorded for bind →
FAQ
BIND is an implementation of the DNS protocols, providing essential services for domain name resolution on the internet.
The vulnerabilities can lead to cache poisoning, unauthorized access, and denial of service, compromising the integrity and availability of DNS services.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement temporary workarounds such as restricting access through firewall rules and disabling unused features until you can apply the update.
Detailed information can be found on the CVE pages for CVE-2025-40778, CVE-2025-40780, and CVE-2025-8677.
Related vulnerabilities
Recent vulnerabilities recorded for bind.
