{"id":"CVE-2025-40780","state":"PUBLISHED","title":"Cache poisoning due to weak PRNG","description":"In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.","publishedAt":"2025-10-22T15:48:27.146Z","updatedAt":"2025-11-04T21:10:16.728Z","severity":{"score":8.6,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","source":"isc"},"assigner":"isc","products":["ISC BIND 9"],"affected":[{"vendor":"ISC","product":"BIND 9","defaultStatus":"unaffected","versions":[{"version":"9.16.0","status":"affected","lessThanOrEqual":"9.16.50","versionType":"custom"},{"version":"9.18.0","status":"affected","lessThanOrEqual":"9.18.39","versionType":"custom"},{"version":"9.20.0","status":"affected","lessThanOrEqual":"9.20.13","versionType":"custom"},{"version":"9.21.0","status":"affected","lessThanOrEqual":"9.21.12","versionType":"custom"},{"version":"9.16.8-S1","status":"affected","lessThanOrEqual":"9.16.50-S1","versionType":"custom"},{"version":"9.18.11-S1","status":"affected","lessThanOrEqual":"9.18.39-S1","versionType":"custom"},{"version":"9.20.9-S1","status":"affected","lessThanOrEqual":"9.20.13-S1","versionType":"custom"}]}],"references":["https://kb.isc.org/docs/cve-2025-40780","http://www.openwall.com/lists/oss-security/2025/10/22/1"],"weaknesses":["CWE-341"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40780.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40780","state":"PUBLISHED","datePublished":"2025-10-22T15:48:27.146Z","dateUpdated":"2025-11-04T21:10:16.728Z","assignerShortName":"isc","assignerOrgId":"404fd4d2-a609-4245-b543-2c944a302a22","dateReserved":"2025-04-16T08:44:49.857Z"},"containers":{"cna":{"title":"Cache poisoning due to weak PRNG","descriptions":[{"lang":"en","value":"In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.\nThis issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1."}],"affected":[{"vendor":"ISC","product":"BIND 9","defaultStatus":"unaffected","versions":[{"version":"9.16.0","status":"affected","lessThanOrEqual":"9.16.50","versionType":"custom"},{"version":"9.18.0","status":"affected","lessThanOrEqual":"9.18.39","versionType":"custom"},{"version":"9.20.0","status":"affected","lessThanOrEqual":"9.20.13","versionType":"custom"},{"version":"9.21.0","status":"affected","lessThanOrEqual":"9.21.12","versionType":"custom"},{"version":"9.16.8-S1","status":"affected","lessThanOrEqual":"9.16.50-S1","versionType":"custom"},{"version":"9.18.11-S1","status":"affected","lessThanOrEqual":"9.18.39-S1","versionType":"custom"},{"version":"9.20.9-S1","status":"affected","lessThanOrEqual":"9.20.13-S1","versionType":"custom"}]}],"references":[{"url":"https://kb.isc.org/docs/cve-2025-40780","name":"CVE-2025-40780","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","baseScore":8.6,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-341","lang":"en","type":"CWE","description":"CWE-341 Predictable from Observable State"}]}],"providerMetadata":{"shortName":"isc","orgId":"404fd4d2-a609-4245-b543-2c944a302a22","dateUpdated":"2025-10-22T15:48:27.146Z"},"datePublic":"2025-10-22T00:00:00.000Z","impacts":[{"descriptions":[{"lang":"en","value":"BIND can be tricked into caching attacker responses, if the spoofing is successful."}]}],"workarounds":[{"lang":"en","value":"No workarounds known."}],"exploits":[{"lang":"en","value":"We are not aware of any active exploits."}],"solutions":[{"lang":"en","value":"Upgrade to the patched release most closely related to your current version of BIND 9: 9.18.41, 9.20.15, 9.21.14, 9.18.41-S1, or 9.20.15-S1."}],"credits":[{"lang":"en","value":"ISC would like to thank Prof. Amit Klein and Omer Ben Simhon from Hebrew University of Jerusalem for bringing this vulnerability to our attention."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-22T17:27:36.366032Z","id":"CVE-2025-40780","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-22T17:27:49.476Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/10/22/1"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T21:10:16.728Z"}}]}}}