ISC BIND CVE-2025-40780
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInduce resolver to query attacker-influenced name
-
DeliveryObserve/predict randomized query state
-
ExploitFlood spoofed forged DNS responses
-
ExecutionResolver caches poisoned record
-
ImpactDownstream clients redirected to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Predictable value prevention
|
| Exploitation Conditions | Exploitation targets a recursive/caching BIND 9 resolver (not an authoritative-only server) that an attacker can cause to perform outbound lookups, and relies on the predictable randomness source described by CWE-341. Limiting factors: the attacker must win a response-forgery race before the legitimate answer arrives and must be able to prompt the resolver to query a name under attacker influence; it affects resolver deployments specifically, and the fixed Alpine package build 9.20.15-r0 (and the corresponding upstream BIND fix) removes the predictability. Exact non-default configuration dependencies are not stated in the supplied one-line description and should be confirmed against the ISC advisory. |
| Impact | Signals conflict sharply in severity-versus-likelihood terms. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, base 8.6) rates this HIGH: network-reachable, no authentication, no user interaction, with a scope change and HIGH integrity impact consistent with DNS cache poisoning arising from CWE-341 (Predictable from Observable State - a weak/predictable randomness source). Against that, exploitation-likelihood signals are low: EPSS is 0.03% (8th percentile), this is NOT on CISA KEV, and no public proof-of-concept is referenced. So this is a genuinely serious-impact DNS resolver flaw but, on current intelligence, not under active or imminent mass exploitation - treat it as a patch-promptly item (resolvers are high-value) rather than an emergency drop-everything KEV-class event. Note one tension to verify: the input Tag labels this 'Information Disclosure', yet the CVSS vector shows C:N/I:H, i.e. an integrity (cache-poisoning) issue, not confidentiality - verify the true impact class against the ISC advisory. Also, the practical attack complexity of defeating a PRNG off-path is often higher than AC:L implies; confirm with ISC's own rating. |
| Exploit ScenarioDerived | An off-path attacker who can induce a vulnerable BIND 9 resolver to issue outbound queries predicts the resolver's randomized query parameters (owing to the predictable-state weakness) and races a forged DNS response into the resolver. The accepted forgery poisons the cache, so subsequent clients of that resolver are steered to attacker-controlled addresses. No public exploit code is referenced at time of analysis, and the low EPSS suggests this remains theoretical/targeted rather than commoditized. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 08, 2026
Cache-poisoning response forgery in ISC BIND 9 recursive/caching resolvers (as packaged by Alpine Linux) lets remote unauthenticated attackers inject forged DNS answers into the resolver's cache by abusing a predictable randomness source (CWE-341), producing high integrity impact with a scope change while leaving confidentiality and availability unaffected. Practical exploitation is constrained: the attacker must be able to prompt the resolver to look up a name under their influence and must win a race against the legitimate answer before it arrives, which is why our assessed vector rates it AC:H rather than the published AC:L. Severity and likelihood therefore conflict sharply - an 8.6 base score against an EPSS of 0.03% (8th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; Alpine has shipped the fix in bind 9.20.15-r0 and ISC published advisory KB cve-2025-40780. Authoritative-only BIND deployments are not the target; recursive resolver deployments are.
Earlier versions of this analysis (1)
BIND DNS server on Alpine Linux was patched at package version 9.20.15-r0, addressing an unspecified vulnerability in the ISC BIND 9.20.x release series. The underlying flaw details - including attack vector, impact class, and affected component - are not disclosed in the available CVE record, making precise impact assessment impossible at this time. EPSS exploitation probability is 0.03% (8th percentile), and no public exploit or CISA KEV listing has been identified.
RemediationAI
Vendor-released patch: Alpine Linux bind 9.20.15-r0 - upgrade immediately with apk upgrade bind (or apk add bind=9.20.15-r0 to pin the fixed build), then restart the named service so the new resolver binary is loaded; this build incorporates the upstream ISC fix described in https://kb.isc.org/docs/cve-2025-40780, corroborated by the oss-security post at http://www.openwall.com/lists/oss-security/2025/10/22/1. If the package cannot be upgraded on a given host, the most effective compensating control is to stop the affected service from being an open recursive resolver for untrusted clients: disable recursion (recursion no; in named.conf) or restrict allow-recursion/allow-query to trusted client ranges and block inbound UDP/TCP 53 from the internet - the trade-off is that any external clients depending on that resolver lose name resolution, so this is only viable for hosts that are not meant to serve strangers. Enabling DNSSEC validation reduces the chance that a forged answer is accepted for signed zones but does not remove the underlying randomness weakness, and source-port randomization plus DNS cookies (server and client cookie support where available) narrow the race window without constituting a fix. Because exploitation requires the attacker to win a response race, and EPSS is low (0.03%, 8th percentile) with no KEV listing or public exploit identified, prioritise patching internet-reachable recursive resolvers first, then internal ones.
Affected ProductsAI
The affected artifact in this record is the Alpine Linux bind package, where all builds prior to 9.20.15-r0 are vulnerable and 9.20.15-r0 is the first fixed build; upstream, the corresponding defect affects ISC BIND 9 recursive/caching resolvers that perform outbound lookups for clients, while authoritative-only servers are not the exploitation target. No CPE identifiers, upstream version range, or vendor package metadata beyond the Alpine fix version were included in the supplied data, so the precise upstream affected-version matrix should be confirmed in the ISC advisory at https://kb.isc.org/docs/cve-2025-40780 and the oss-security disclosure at http://www.openwall.com/lists/oss-security/2025/10/22/1; a third-party write-up is available at https://vuldb.com/vuln/329394. Alpine users can confirm exposure with apk list -I bind and checking the reported version.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-341 (predictable values derived from observable state): the resolver's outbound query state - the transaction identifier and related per-query randomness used to match an incoming UDP response to an outstanding question - can be predicted by an off-path attacker rather than being drawn from a sufficiently unpredictable source. With that predictability, an attacker who can trigger the resolver to query a name they control can send a response that matches the resolver's outstanding query and is accepted, poisoning cached data that downstream clients then trust; the resulting CVSS profile is integrity-only with scope change (S:C/I:H/C:N/A:N), which is consistent with forged-answer injection rather than data theft or denial of service. Exploitation is limited to recursive/caching BIND 9 resolver deployments that perform outbound lookups on behalf of clients, and is further gated by the response-race condition; because the flaw is in query-state generation rather than in a protocol-visible feature, there is no configuration flag that removes the exposure short of patching. No CPE strings or upstream version ranges were supplied in this record, so the exact affected upstream version boundaries must be taken from the ISC advisory at https://kb.isc.org/docs/cve-2025-40780; Alpine's packaging fix is bind 9.20.15-r0, with the upstream fix referenced in the oss-security post dated 2025-10-22 (http://www.openwall.com/lists/oss-security/2025/10/22/1). Some third-party scoring and the record's tags label this as information disclosure, but the assessed impact is cache/answer modification (integrity), not disclosure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Network, unauthenticated, no UI; but defeating a PRNG off-path and winning the forgery race is non-trivial, so AC:H; scope changes to downstream clients and integrity impact is HIGH (cache poisoning), no C/A impact.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: bind fixed in 9.20.15-r0
Executive ViewAI
A high-severity cache-poisoning vulnerability in ISC BIND 9 recursive resolvers, notably those packaged by Alpine Linux, could allow remote attackers to inject forged DNS answers, compromising the integrity of domain name resolution. While no public exploit identified at time of analysis and exploitation requires winning a race condition, a successful attack could redirect users to malicious sites and disrupt trust in network communications. Leadership should ensure that all recursive resolver deployments are promptly patched to maintain the security of critical business operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB