Alpine Linux BIND CVE-2025-40780

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:15 vuln.today

DescriptionCVE.org

Alpine Linux: bind fixed in 9.20.15-r0

AnalysisAI

BIND DNS server on Alpine Linux was patched at package version 9.20.15-r0, addressing an unspecified vulnerability in the ISC BIND 9.20.x release series. The underlying flaw details - including attack vector, impact class, and affected component - are not disclosed in the available CVE record, making precise impact assessment impossible at this time. EPSS exploitation probability is 0.03% (8th percentile), and no public exploit or CISA KEV listing has been identified.

Technical ContextAI

ISC BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software; Alpine Linux packages it as 'bind'. The affected version series is 9.20.x, which is a stable branch of BIND 9. The fix is delivered as Alpine Linux package version 9.20.15-r0, indicating the upstream ISC BIND release 9.20.15 was incorporated into Alpine's package tree. No CWE root cause classification, CVSS vector, or technical description of the vulnerability class is available in the provided data, so the specific vulnerable component within BIND (e.g., named daemon, resolver, zone transfer logic, DNSSEC handling) cannot be determined from this record alone.

Affected ProductsAI

Alpine Linux systems running the 'bind' package at versions prior to 9.20.15-r0 are affected. The upstream software is ISC BIND version 9.20.x (prior to 9.20.15). No CPE strings were provided in the available data. The fix was reported by the Alpine Linux vendor. Administrators should consult the Alpine Linux security advisories and ISC's official BIND 9.20.15 release notes for the authoritative list of affected versions and configurations.

RemediationAI

Upgrade the Alpine Linux 'bind' package to version 9.20.15-r0 or later using the standard Alpine package manager: 'apk update && apk upgrade bind'. This is the vendor-released fix as reported by Alpine Linux. Because the specific vulnerability details are not disclosed in this record, targeted workarounds cannot be recommended with confidence. As a general compensating control pending upgrade, restricting external access to the BIND service (TCP/UDP port 53) to only known and authorized clients via firewall rules can reduce exposure, though this may impact legitimate DNS resolution for dependent services. Administrators should also review ISC's official BIND 9.20.15 changelog directly for any configuration-level mitigations applicable to specific deployment scenarios.