Critical Denial of Service Vulnerability in Bind9 Package
Summary
USN-7641-1: bind9 vulnerability. Affects bind9 versions < 1:9.20.4-3ubuntu1.2. Fixed in 1:9.20.4-3ubuntu1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bind9 is a widely used DNS server software that provides name resolution services for the internet. It is known for its robustness and flexibility, supporting various DNS features and configurations. However, it is susceptible to vulnerabilities that can compromise its stability and security, such as the one identified in this report.
Vulnerability Detail
The vulnerability arises from an improper handling of configurations where the stale-answer-client-timeout option is set to 0. This flaw allows a remote attacker to exploit the issue, potentially causing the Bind9 service to crash, leading to a denial of service. The vulnerability has been assigned the identifier CVE-2025-40777, highlighting its significance in the context of network security.
How To Fix
Minimum fixed version
1:9.20.4-3ubuntu1.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bind9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can set the stale-answer-client-timeout option to a non-zero value in your Bind9 configuration file to mitigate the risk of exploitation until you can apply the patch.
Conclusion
In summary, the Bind9 vulnerability identified as CVE-2025-40777 poses a significant risk of denial of service due to improper configuration handling. It is crucial to update to the patched version to mitigate this risk and ensure the stability of your DNS services.
See every vulnerability recorded for bind9 →
FAQ
The vulnerability can lead to a denial of service, causing the Bind9 service to crash and disrupt DNS resolution.
You can verify your Bind9 version by running 'named -v' in your terminal. If it matches the affected version, you should apply the patch.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can implement a workaround by adjusting the stale-answer-client-timeout option in your configuration to a non-zero value.
Detailed information can be found in the Ubuntu Security Notices, specifically USN-7641-1, which outlines the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for bind9.
