CVE-2025-40775

Published May 21, 2025

Last updated a month ago

CVSS high 7.5

BIND 9

Dns

Port (53)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-40775 affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7. The vulnerability arises when BIND encounters an incoming DNS protocol message that includes a Transaction Signature (TSIG). Specifically, the vulnerability triggers when the TSIG contains an invalid value in the algorithm field. In such cases, BIND immediately aborts with an assertion failure.

Description: When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.
Source: security-officer@isc.org
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

security-officer@isc.org: CWE-232

Hype score: Not currently trending

References

Sources include official advisories and independent security research.