Target Industry
Indiscriminate, opportunistic targeting.
Overview
Two high severity vulnerabilities have been discovered in the BIND 9 DNS resolver software, potentially allowing cache poisoning and denial-of-service (DoS) attacks. BIND 9 is open-source software that resolves domain names to IP addresses. These vulnerabilities could affect organisations globally, especially those using advanced DNS configurations.
The first vulnerability is being tracked as CVE-2025-40776 (CVSS Score of 8.8) which enables DNS cache poisoning via a birthday attack, bypassing existing defence. The second is tracked as CVE-2025-40777 (CVSS score of 7.5) and allows remote attackers to crash DNS servers through crafted queries, leading to denial-of-service.
Affected Products
CVE-2025-40776 – BIND 9 Subscription Edition with EDNS Client Subnet (ECS) enabled.
CVE-2025-40777 – BIND 9 versions 9.20.0–9.20.10 and 9.21.0–9.21.9.
Impact
CVE-2025-40776 may lead to cache poisoning, potentially redirecting users to malicious websites, resulting in data breaches and loss of user confidence. CVE-2025-40777 can disrupt DNS services, causing downtime and financial impact due to reduced service availability.
Exploitation
CVE-2025-40776 can be exploited by sending specially crafted DNS queries to a vulnerable resolver, increasing the chances of successful cache poisoning. Attackers can leverage the ECS configuration to manipulate the resolver’s behaviour. CVE-2025-40777 can be exploited by crafting queries that trigger the specific conditions leading to assertion failures, causing the DNS service to crash.
Containment, Mitigations & Remediations
It is highly recommended to update software with the latest versions. For CVE-20250–40776, disable ECS through the removal of the ecs-zones directive from the named.conf configuration file. And for CVE-2025-40777 disable stale answers by setting stale-answer-client-timeout off or stale-answer-enable no in the configuration.
Threat Landscape
DNS infrastructure remains a high-value target for attackers due to its central role in internet operations. These vulnerabilities increase the risk of traffic interception, service disruption, and broader cyberattacks, especially in environments with complex DNS configurations.
Threat Group
No specific threat actor or group has been publicly linked to active exploitation of these vulnerabilities at this time. However, the techniques involved are within the capabilities of advanced persistent threat (APT) groups and cybercriminals.
Further Information
