Loading story…
A high-severity vulnerability, CVE-2025-40778, has been identified in BIND 9 DNS resolvers, exposing over 706,000 servers worldwide to cache poisoning attacks. The flaw, which carries a CVSS v3.1 score of 8.6, allows remote, unauthenticated attackers to inject forged DNS records into resolver caches by exploiting BIND's overly permissive acceptance of certain DNS records in responses. This manipulation can redirect internet traffic to malicious sites, facilitate malware distribution, or enable interception of network communications, posing a significant risk to global DNS infrastructure.
The Internet Systems Consortium (ISC) has released advisories and patches addressing the vulnerability in multiple supported and preview versions of BIND 9, including versions 9.18.41, 9.20.15, and 9.21.14, as well as corresponding Supported Preview Edition releases. The publication of proof-of-concept exploit code has heightened the urgency for administrators to patch affected systems, particularly those running recursive DNS servers. While no active exploitation has been observed yet, the widespread use of BIND 9 and the critical nature of DNS services make prompt remediation essential to prevent large-scale attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Germany's BSI published additional recommendations for securing recursive DNS servers, while multiple Linux distributions had already integrated or were preparing patches. These follow-on actions reflected broader ecosystem response to the vulnerability disclosure.
Proof-of-concept exploit code for CVE-2025-40778 was published, increasing the urgency of patching despite no active exploitation being observed at the time. The publication lowered the barrier for attackers to attempt DNS cache-poisoning attacks.
Reporting on the disclosure said the flaw threatened global DNS infrastructure and exposed roughly 706,000 internet-facing servers. The scale of exposure elevated concern over potential widespread abuse if exploitation began.
Fixes for CVE-2025-40778 were made available in BIND 9 versions 9.18.41, 9.20.15, 9.21.14 and corresponding Supported Preview Edition releases. Administrators were advised to upgrade immediately because no workaround was available.
A high-severity vulnerability, CVE-2025-40778, was disclosed in BIND 9 DNS resolvers that allows remote, unauthenticated attackers to poison DNS cache by injecting forged records. The issue also affects authoritative DNS servers when recursion is enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ISC released security advisories addressing several high-severity vulnerabilities in *BIND 9* DNS software, affecting versions 9.11.x, 9.16.x, 9.18.x, 9.20.x, and 9.21.x. These flaws could allow attackers to conduct cache poisoning and denial of service (DoS) attacks, potentially disrupting DNS resolution and compromising the integrity of DNS responses. The vulnerabilities are tracked as CVE-2025-8677, CVE-2025-40778, and CVE-2025-40780, and have been rated as critical due to their potential impact on DNS infrastructure. Administrators are strongly advised to review the official advisories and apply the necessary patches to affected BIND 9 deployments. The Canadian Centre for Cyber Security and other security organizations have issued alerts urging immediate action to mitigate the risk of exploitation. Failure to update could expose organizations to significant operational and security risks, including service outages and the possibility of malicious redirection of network traffic.
Jun 29, 2026
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026
Internet Systems Consortium (ISC) disclosed six vulnerabilities in **BIND 9** and released patched versions `9.18.49`, `9.20.23`, and `9.21.22`. The issues include **CVE-2026-3039**, a high-severity memory-exhaustion flaw during GSS-API TKEY negotiation that can crash `named`; **CVE-2026-3593**, a high-severity heap use-after-free in the DNS-over-HTTPS implementation triggered by crafted HTTP/2 traffic; **CVE-2026-3592**, an amplification issue involving self-pointed glue records that can drive disproportionate bandwidth and resource consumption; **CVE-2026-5947**, a race condition in SIG(0) validation under query-flood conditions that can lead to undefined behavior and process crashes; plus additional flaws involving invalid handling of `CLASS != IN` and an unbounded resend loop in the resolver. ISC said the vulnerabilities are remotely exploitable in affected configurations, with the most serious impacts centered on denial of service, memory corruption, and resolver abuse rather than confirmed code execution. Exposure depends on feature use: the GSS-API issue is especially relevant to Active Directory-integrated or Kerberos-secured DNS deployments, while the DoH flaw affects only servers with DNS-over-HTTPS enabled and can be mitigated by disabling that feature until upgrades are applied. ISC reported no known active exploitation at disclosure time, said no workaround is known for several of the bugs, and credited external researchers including Vitaly Simonovich, Naoki Wakamatsu, Naresh Kandula Parmar, and Shuhan Zhang for reporting the flaws.
Jun 29, 2026