ISC BIND CVE-2025-40778

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:15 vuln.today

DescriptionCVE.org

Alpine Linux: bind fixed in 9.20.15-r0

AnalysisAI

ISC BIND received a security fix in Alpine Linux package version 9.20.15-r0, addressing CVE-2025-40778. The nature of the underlying vulnerability - its impact class, affected attack surface, and exploitability - is not determinable from the available data, as no CVSS vector, CWE classification, or vendor advisory details were provided. EPSS scoring of 0.01% at the 0th percentile indicates extremely low assessed exploitation probability at time of analysis. No public exploit identified at time of analysis.

Technical ContextAI

ISC BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software, maintained by the Internet Systems Consortium (ISC). Alpine Linux ships BIND as its 'bind' package. The fix version 9.20.15-r0 follows Alpine's packaging convention where the suffix '-r0' denotes the first Alpine-specific package revision of upstream BIND 9.20.15. BIND 9.20.x is an active maintenance branch. Without a CWE classification or CVSS vector, the root cause class - whether a memory safety issue, logic flaw, resource exhaustion, or protocol-level vulnerability - cannot be determined from the provided data. The ISC typically publishes security advisories at kb.isc.org for BIND CVEs; no such advisory URL was supplied in the input data.

Affected ProductsAI

Alpine Linux ships ISC BIND and the vulnerability is addressed in Alpine package version bind-9.20.15-r0. Versions of Alpine Linux shipping BIND packages prior to 9.20.15-r0 are affected. The specific Alpine Linux release branches carrying the vulnerable package (e.g., Alpine 3.x edge, stable branches) are not enumerated in the provided data. No CPE strings were supplied. Upstream BIND versions prior to 9.20.15 on the 9.20.x branch may also be affected; other BIND branches (9.18.x, 9.21.x) are not addressed in the available data. Consult the Alpine Linux security tracker and the ISC BIND security advisory for definitive affected version ranges.

RemediationAI

The primary remediation is to upgrade the Alpine Linux BIND package to version 9.20.15-r0 or later using the Alpine package manager: 'apk upgrade bind'. Alpine Linux users should ensure their package repositories are updated and apply this fix during their next maintenance window or sooner depending on local risk tolerance. No specific workarounds, compensating controls, or configuration changes are documented in the available data because the vulnerability class and attack surface are unknown. If operating BIND in high-risk environments, consider consulting the ISC security advisory (kb.isc.org) for any documented mitigations applicable before patching. No advisory URL was included in the provided reference data.