The Internet Systems Consortium (ISC) released BIND versions 9.18.37, 9.20.9, and 9.21.8 on May 21, 2025, to address the security flaw identified as CVE-2025-40775.
This vulnerability affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7, though notably, the existing Extended Support Version (ESV) branch 9.18. X remains unaffected.
Security experts warn that exploitation could disrupt DNS operations across vulnerable servers, potentially affecting large portions of the internet infrastructure.
The vulnerability stems from improper handling of Transaction Signatures (TSIG) in BIND’s DNS implementation.
BIND performs validation checks on these signatures when processing incoming DNS protocol messages that include a TSIG.
However, when a TSIG contains an invalid value in the algorithm field, affected versions of BIND immediately abort with an assertion failure.
This issue is classified under CWE-232 (Improper Handling of Undefined Values) and has received a CVSS base score of 7.5, indicating high severity.
Transaction Signatures (TSIG) are a security mechanism used to authenticate DNS message exchanges between servers. When any server sends a TSIG-signed DNS request, it expects the response to be signed with the same key.
However, the validation process for these signatures contains the vulnerable code that occurs early in the packet handling routine, making it difficult to defend against without patching.
Similar to previous BIND vulnerabilities, this flaw can affect both authoritative and recursive DNS servers, and standard access control lists (ACLs) provide no protection against exploitation.
| Risk Factors | Details |
| Affected Products | BIND 9.20.0 – 9.20.8, BIND 9.21.0 – 9.21.7 |
| Impact | Denial of service |
| Exploit Prerequisites | Ability to send malicious DNS packets to vulnerable servers (remote, unauthenticated) |
| CVSS 3.1 Score | 7.5 (High) |
The vulnerability allows for remote exploitation without requiring authentication, this means attackers can target vulnerable systems from anywhere on the internet with relatively low complexity.
While the exploit doesn’t allow for data theft or system compromise, it can effectively cause denial-of-service conditions by forcing DNS servers to crash.
Similar historical vulnerabilities in BIND have demonstrated the potential widespread impact of such flaws.
Security researcher Rob Graham previously warned how easy it could be to “blanket the internet with those packets and crash all publicly facing BIND9” servers during a previous vulnerability disclosure.
DNS servers are fundamental components of internet infrastructure, translating domain names into numeric IP addresses, which makes their availability crucial for normal internet operations.
Organizations running affected versions should immediately update to the patched versions: BIND 9.20.9 or 9.21.8.
These maintenance releases are available for download from the ISC software download page, with updates for packages and container images being rolled out shortly after the initial release.
There are currently no known workarounds for this vulnerability other than applying the appropriate patch, which is reported to be completely effective. Administrators should note that:
The vulnerability affects only BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7. The ESV branch (9.18. X) is not affected by this vulnerability
The ISC recommends regularly checking for updates and patches to ensure the DNS infrastructure remains secure and efficient.
Additionally, organizations should stay informed about platform deprecation timelines, noting that support for RHEL 7 ended in June 2024, and BIND will not be compatible with RHEL 7 moving forward.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
The post BIND DNS Vulnerability Let Attackers Crash DNS Servers With Malicious Packet appeared first on Cyber Security News.
The U.S. Capitol on March 3, 2026. (Photo by Jennifer Shutt/States Newsroom)WASHINGTON — U.S. Senate…
The new trailer for Dune: Part 3 just dropped and it looks incredible. The third…
Iran’s cyber operations took a sharp turn in early 2026, with state-linked threat actors quietly…
Karen Tilly is being recognized as a Remarkable Woman for her years of service and…
A plan to build 32 new housing units along Alpine Road in Rockford, IL, consisting…
Invincible is returning for its fourth season, which will finally pit Mark against one of…
This website uses cookies.