Introduction
DNS cache poisoning can silently redirect users and systems to attacker-controlled infrastructure, which undermines the integrity of internet communications. CVE-2025-40778, the latest high-severity flaw in BIND 9, exposes a wide range of recursive resolvers to remote cache poisoning. Under specific conditions, an attacker can inject forged DNS records into the cache. The flaw matters because BIND is ubiquitous in enterprise and service provider environments, where it is the backbone of DNS resolution.
About BIND and ISC: BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software in the world. It is maintained by the Internet Systems Consortium (ISC), a nonprofit with a long-standing role in DNS protocol development and security. ISPs, enterprises, and governments run critical infrastructure on BIND, so a vulnerability in it has a large impact across the global internet.
Technical information
CVE-2025-40778 comes from how BIND 9 handles unsolicited resource records (RRs) in DNS responses. When a recursive resolver queries an authoritative nameserver, the response may carry extra records in the authority and additional sections alongside the requested answer. A correct DNS implementation validates these records strictly and caches only the ones that are relevant and within the expected bailiwick (the zone of authority).
In affected BIND 9 versions, the resolver is too lenient about which records it accepts from answers, and it may cache resource records that the original query never explicitly asked for. That violates bailiwick checking, which exists to stop a nameserver from injecting data for domains outside its authority. The vulnerability is classified under CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data (CWE-349).
An attacker who can influence DNS responses, either by running a malicious authoritative nameserver or by intercepting resolver traffic, can use the flaw to inject forged records into the cache. Once the cache is poisoned, the resolver returns the attacker's data for later queries until the cache entry expires or is flushed. The attacker can then redirect users to malicious sites, intercept sensitive data, or deny legitimate services.
As of this writing, no public source has published code snippets or internal implementation details. Only recursive resolver configurations are affected. Authoritative-only BIND servers are not affected unless they also perform recursion.
Affected systems and versions
CVE-2025-40778 affects the following BIND 9 versions:
- 9.11.0 through 9.16.50
- 9.18.0 through 9.18.39
- 9.20.0 through 9.20.13
- 9.21.0 through 9.21.12
- 9.11.3-S1 through 9.16.50-S1
- 9.18.11-S1 through 9.18.39-S1
- 9.20.9-S1 through 9.20.13-S1
Only recursive resolver configurations are affected. Authoritative-only servers are not vulnerable unless recursion is enabled.
Fixed versions:
- 9.18.41
- 9.20.15
- 9.21.14
- 9.18.41-S1
- 9.20.15-S1
There are no workarounds. Upgrade immediately.
Vendor security history
ISC has a long record of fixing DNS security issues in BIND. Earlier notable vulnerabilities include:
- The Kaminsky bug (2008), a landmark DNS cache poisoning flaw
- MAGINOTDNS (2023), which exploited inconsistencies in bailiwick checking
- Multiple logic and validation errors in DNS response handling
ISC maintains a detailed vulnerability matrix and publishes advisories promptly. For CVE-2025-40778 it followed responsible disclosure and released patches for all supported branches. Its communication is transparent, and it collaborates on security research on an ongoing basis.
