Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-40778

Cache poisoning attacks with unsolicited RRs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
isc

Description

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ISC BIND 9

Default version status: unaffected

  • 9.11.0 to ≤ 9.16.50affected
  • 9.18.0 to ≤ 9.18.39affected
  • 9.20.0 to ≤ 9.20.13affected
  • 9.21.0 to ≤ 9.21.12affected
  • 9.11.3-S1 to ≤ 9.16.50-S1affected
  • 9.18.11-S1 to ≤ 9.18.39-S1affected
  • 9.20.9-S1 to ≤ 9.20.13-S1affected

References