Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-40780

Cache poisoning due to weak PRNG

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
isc

Description

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ISC BIND 9

Default version status: unaffected

  • 9.16.0 to ≤ 9.16.50affected
  • 9.18.0 to ≤ 9.18.39affected
  • 9.20.0 to ≤ 9.20.13affected
  • 9.21.0 to ≤ 9.21.12affected
  • 9.16.8-S1 to ≤ 9.16.50-S1affected
  • 9.18.11-S1 to ≤ 9.18.39-S1affected
  • 9.20.9-S1 to ≤ 9.20.13-S1affected

References