ISC BIND CVE-2025-40776

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:18 vuln.today

DescriptionCVE.org

Alpine Linux: bind fixed in 9.20.11-r0

AnalysisAI

ISC BIND DNS server received a security fix in Alpine Linux package version 9.20.11-r0, addressing an unspecified vulnerability tracked as CVE-2025-40776. The underlying nature of the flaw - including attack vector, affected component, and exploitability conditions - has not been publicly disclosed at time of analysis. With an EPSS score of 0.05% (15th percentile) and no CISA KEV listing, this vulnerability does not currently exhibit signals of widespread active exploitation, though the absence of CVSS and CWE data substantially limits risk characterization.

Technical ContextAI

The affected software is ISC BIND, the widely deployed open-source DNS server maintained by the Internet Systems Consortium. In Alpine Linux's packaging convention, the version string '9.20.11-r0' corresponds to BIND upstream version 9.20.11 packaged as Alpine revision 0, placing it in the BIND 9.20.x stable branch. No CWE identifier is available to characterize the root cause class, and no CPE string was provided in the source intelligence. The specific BIND component or subsystem (e.g., named resolver, DNSSEC validation, zone transfer, query processing) involved in this vulnerability is not disclosed in the available data.

Affected ProductsAI

The affected product is ISC BIND as packaged for Alpine Linux. Based on the fix being applied at 9.20.11-r0, Alpine Linux versions shipping BIND packages prior to 9.20.11-r0 in the 9.20.x branch are affected. Specific affected Alpine Linux release branches (e.g., Alpine 3.x edge or stable) and the precise BIND upstream version range below 9.20.11 are not confirmed in available data. No CPE string was provided. Users should consult the Alpine Linux security tracker and ISC advisories for definitive affected-version ranges.

RemediationAI

The primary remediation is to upgrade the Alpine Linux bind package to version 9.20.11-r0 or later using the Alpine package manager: 'apk upgrade bind'. This package version is vendor-confirmed as the fix per Alpine Linux's own security reporting. No upstream ISC advisory URL was available in the provided intelligence, so administrators should also consult https://kb.isc.org/docs/security-advisories for any corresponding ISC advisory that may detail additional context or workarounds. If immediate patching is not feasible and the vulnerability affects an externally exposed named instance, consider restricting recursive query access to trusted clients via named.conf ACLs, rate-limiting queries, or placing the DNS resolver behind network-layer controls as interim compensating measures - noting these may impact DNS service availability for legitimate clients.