CVE-2025-40776

Published Jul 16, 2025

Last updated 2 months ago

BIND 9

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-40776 is a vulnerability affecting BIND 9's caching resolver when it is configured to send ECS (EDNS Client Subnet) options. This vulnerability can potentially expose the resolver to cache-poisoning attacks. The issue affects BIND 9 Subscription Edition versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1. The vulnerability makes resolvers with ECS enabled more susceptible to cache poisoning through spoofed query responses. An attacker could bypass existing cache poisoning attack mitigations. Disabling ECS in BIND or upgrading to patched releases 9.18.38-S1 or 9.20.11-S1 can mitigate this vulnerability.

Description: A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.
Source: security-officer@isc.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.6
Impact score: 4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Severity: HIGH

Weaknesses

security-officer@isc.org: CWE-349

Hype score: Not currently trending

References