Introduction
A single DNS query can render an entire resolver unresponsive if it targets a zone with maliciously crafted DNSKEY records. BIND 9 is backbone DNS software for ISPs, enterprises, and critical infrastructure, and it is directly affected. CVE-2025-8677 is a CPU exhaustion flaw that can be triggered remotely, and it puts DNS resolution at risk for any organization running a vulnerable BIND 9 version.
BIND (Berkeley Internet Name Domain) is the most widely used DNS server software in the world, maintained by the Internet Systems Consortium (ISC). It runs in telecom backbones and enterprise networks, with millions of deployments worldwide. Because so many operators run it and rely on it, any vulnerability in BIND is a global operational concern.
Technical information
CVE-2025-8677 is a resource exhaustion vulnerability in the DNSSEC validation logic of BIND 9. When a recursive resolver queries a DNS zone that contains specially crafted malformed DNSKEY records, the validation process can enter a state that consumes excessive CPU. The cause is the way BIND processes DNSKEY records and attempts to validate DNSSEC signatures.
The attacker must control or compromise an authoritative DNS zone. Once that zone is populated with malformed DNSKEY records, any recursive resolver that queries it will fetch those records and try to validate them. Because the records are malformed, BIND's validation logic performs computationally expensive operations until the CPU is exhausted. This can degrade or completely deny DNS resolution for every client that relies on the affected resolver.
Key technical points:
- The vulnerability is triggered during DNSSEC validation when BIND processes malformed DNSKEY records.
- Attackers must control or compromise an authoritative zone to serve the malformed records.
- Exploitation is remote, requires no authentication, and has low complexity.
- Authoritative-only BIND servers are not affected. Only recursive resolvers that perform DNSSEC validation are vulnerable.
- No workaround is available. Mitigation requires patching.
No vulnerable code snippets have been published in public sources as of this writing.
Affected systems and versions
The following BIND 9 versions are vulnerable:
- 9.18.0 through 9.18.39
- 9.20.0 through 9.20.13
- 9.21.0 through 9.21.12
- 9.18.11-S1 through 9.18.39-S1 (Supported Preview Edition)
- 9.20.9-S1 through 9.20.13-S1 (Supported Preview Edition)
Only recursive resolver configurations are affected. Authoritative-only servers are not affected.
Vendor security history
The Internet Systems Consortium has a long record of responding to DNS security issues promptly and openly. Earlier BIND vulnerabilities with a similar resource exhaustion impact include:
- CVE-2023-50387 (KeyTrap): DNSSEC validation CPU exhaustion
- CVE-2023-50868: NSEC3 hash iteration CPU exhaustion
ISC regularly coordinates with external researchers and publishes detailed advisories. Its patches generally arrive quickly, with fixes released for all supported branches.
