BIND DNS Server CVE-2025-40777

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:18 vuln.today

DescriptionCVE.org

Alpine Linux: bind fixed in 9.20.11-r0

AnalysisAI

BIND DNS server received a security fix in Alpine Linux package version 9.20.11-r0, addressing an unspecified vulnerability tracked as CVE-2025-40777. The affected product is ISC BIND as packaged in Alpine Linux, with the fix delivered via the Alpine package repository. No public exploit has been identified at time of analysis, and the EPSS score of 0.10% (27th percentile) reflects low observed exploitation probability.

Technical ContextAI

BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software, maintained by ISC and packaged by Linux distributions including Alpine Linux. The Alpine package versioning convention appends a release suffix (e.g., '-r0') to the upstream version, indicating this is the first Alpine build of BIND 9.20.11. The 9.20.x branch is ISC's current stable series. No CWE classification is available from the provided data, so the root cause class - whether memory corruption, input validation, logic error, or otherwise - cannot be determined from this advisory alone. CPE data was not provided, but the affected component is identifiable as the 'bind' package in Alpine Linux's package repository targeting the 9.20.x series.

Affected ProductsAI

The affected product is ISC BIND as distributed in Alpine Linux, specifically versions prior to 9.20.11-r0 in the Alpine package repository. The exact upstream BIND versions affected beyond the 9.20.x series (e.g., 9.18.x LTS or 9.21.x development) are unknown from the available data. No CPE strings were provided. No linked ISC or vendor advisory URL was included in the intelligence data, so the authoritative upstream advisory reference cannot be cited. Users of Alpine Linux running the 'bind' package should consult the Alpine Linux security tracker and ISC's advisories at isc.org for full scope.

RemediationAI

The primary remediation is to upgrade the BIND package on Alpine Linux to version 9.20.11-r0 or later using the Alpine package manager: 'apk upgrade bind'. This is the vendor-released fix per the Alpine Linux security advisory. Users running older BIND major versions (9.18.x, 9.21.x) should check ISC's official security advisories to determine if those branches are separately patched, as Alpine's fix may correspond to a broader ISC advisory affecting multiple supported branches. No specific workarounds can be recommended without knowledge of the vulnerability class or attack vector. If BIND is externally exposed and patching cannot occur immediately, restricting DNS query access to known clients via ACLs in named.conf is a general hardening measure, though its effectiveness against this specific vulnerability is unconfirmed given missing technical details.