Critical Security Update for BIND 9.16: Cache Poisoning Vulnerabilities
Summary
ALSA-2025:19793: Important: bind9.16 security update. Affects bind9.16 versions < 32:9.16.23-0.22.el8_10.4. Fixed in 32:9.16.23-0.22.el8_10.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the Domain Name System (DNS) protocols. It includes a DNS server (named), a resolver library, and various tools for DNS management. BIND is essential for translating human-readable domain names into IP addresses, making it a cornerstone of internet functionality. However, recent vulnerabilities have been identified that could compromise its integrity and security.
Vulnerability Detail
The vulnerabilities identified in BIND 9.16 include cache poisoning attacks due to unsolicited Resource Records (RRs) and weaknesses in the Pseudo-Random Number Generator (PRNG). These issues can allow attackers to manipulate DNS responses, potentially redirecting users to malicious sites or intercepting sensitive data. The vulnerabilities are tracked under CVE-2025-40778 and CVE-2025-40780, respectively.
How To Fix
Minimum fixed version
32:9.16.23-0.22.el8_10.4
This is the first release that contains the fix.
sudo dnf update bind9.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their DNS servers by implementing access controls and filtering incoming requests to mitigate the risk of cache poisoning attacks. However, this is not a substitute for applying the security update.
Conclusion
The recent vulnerabilities in BIND 9.16 pose significant risks to DNS security. It is essential for users to update to the latest patched version to protect against cache poisoning attacks. Utilizing tools like Vulert can help monitor for vulnerabilities and ensure ongoing security.
See every vulnerability recorded for bind9.16 →
FAQ
Cache poisoning is a type of attack where an attacker inserts false information into a DNS cache, causing users to be directed to malicious sites.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Failing to update BIND can leave your DNS server vulnerable to attacks, potentially leading to data breaches and loss of user trust.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software without requiring code access.
If immediate updates are not possible, implement strict access controls and monitor DNS traffic for unusual activity as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.16.
