Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-40778

Summary
Assigner-isc
Assigner Org ID-404fd4d2-a609-4245-b543-2c944a302a22
Published At-22 Oct, 2025 | 15:47
Updated At-26 Feb, 2026 | 16:57
Rejected At-
Credits

Cache poisoning attacks with unsolicited RRs

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:isc
Assigner Org ID:404fd4d2-a609-4245-b543-2c944a302a22
Published At:22 Oct, 2025 | 15:47
Updated At:26 Feb, 2026 | 16:57
Rejected At:
▼CVE Numbering Authority (CNA)
Cache poisoning attacks with unsolicited RRs

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Affected Products
Vendor
Internet Systems Consortium, Inc.ISC
Product
BIND 9
Default Status
unaffected
Versions
Affected
  • From 9.11.0 through 9.16.50 (custom)
  • From 9.18.0 through 9.18.39 (custom)
  • From 9.20.0 through 9.20.13 (custom)
  • From 9.21.0 through 9.21.12 (custom)
  • From 9.11.3-S1 through 9.16.50-S1 (custom)
  • From 9.18.11-S1 through 9.18.39-S1 (custom)
  • From 9.20.9-S1 through 9.20.13-S1 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-349CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
Type: CWE
CWE ID: CWE-349
Description: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
Metrics
VersionBase scoreBase severityVector
3.18.6HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Version: 3.1
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
N/AForged records can be injected into cache during a query, which can potentially affect resolution of future queries.
CAPEC ID: N/A
Description: Forged records can be injected into cache during a query, which can potentially affect resolution of future queries.
Solutions

Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.41, 9.20.15, 9.21.14, 9.18.41-S1, or 9.20.15-S1.

Configurations
Workarounds

No workarounds known.

Exploits

We are not aware of any active exploits.

Credits
ISC would like to thank Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan from Tsinghua University for bringing this vulnerability to our attention.
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://kb.isc.org/docs/cve-2025-40778
vendor-advisory
Hyperlink: https://kb.isc.org/docs/cve-2025-40778
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://gist.github.com/N3mes1s/f76b4a606308937b0806a5256bc1f918
exploit
Hyperlink: https://gist.github.com/N3mes1s/f76b4a606308937b0806a5256bc1f918
Resource:
exploit
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://www.openwall.com/lists/oss-security/2025/10/22/1
N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/10/22/1
Resource: N/A
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-officer@isc.org
Published At:22 Oct, 2025 | 16:15
Updated At:04 Nov, 2025 | 22:16

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.6HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Type: Secondary
Version: 3.1
Base score: 8.6
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-349Secondarysecurity-officer@isc.org
CWE ID: CWE-349
Type: Secondary
Source: security-officer@isc.org
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://kb.isc.org/docs/cve-2025-40778security-officer@isc.org
N/A
http://www.openwall.com/lists/oss-security/2025/10/22/1af854a3a-2127-422b-91ae-364da2661108
N/A
https://gist.github.com/N3mes1s/f76b4a606308937b0806a5256bc1f918134c704f-9b21-4f2e-91b3-4a467353bcc0
N/A
Hyperlink: https://kb.isc.org/docs/cve-2025-40778
Source: security-officer@isc.org
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2025/10/22/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://gist.github.com/N3mes1s/f76b4a606308937b0806a5256bc1f918
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

2Records found
CVE-2025-40776
Matching Score-10
Assigner-Internet Systems Consortium (ISC)
ShareView Details
Matching Score-10
Assigner-Internet Systems Consortium (ISC)
CVSS Score-8.6||HIGH
EPSS-0.01% / 0.78%
||
7 Day CHG~0.00%
Published-16 Jul, 2025 | 13:41
Updated-22 Jul, 2025 | 14:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Birthday Attack against Resolvers supporting ECS

A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.

Action-Not Available
Vendor-Internet Systems Consortium, Inc.
Product-BIND 9
CWE ID-CWE-349
Acceptance of Extraneous Untrusted Data With Trusted Data
CVE-2025-40780
Matching Score-8
Assigner-Internet Systems Consortium (ISC)
ShareView Details
Matching Score-8
Assigner-Internet Systems Consortium (ISC)
CVSS Score-8.6||HIGH
EPSS-0.03% / 9.23%
||
7 Day CHG~0.00%
Published-22 Oct, 2025 | 15:48
Updated-04 Nov, 2025 | 22:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cache poisoning due to weak PRNG

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Action-Not Available
Vendor-Internet Systems Consortium, Inc.
Product-BIND 9
CWE ID-CWE-341
Predictable from Observable State
Details not found