ISC BIND CVE-2025-8677

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:18 vuln.today

DescriptionCVE.org

Alpine Linux: bind fixed in 9.20.15-r0

AnalysisAI

ISC BIND DNS server software received a security fix in Alpine Linux package version 9.20.15-r0. The specific vulnerability details, attack surface, and impact class are not disclosed in available intelligence - the sole confirmed data point is that the Alpine Linux vendor issued a patched package. With an EPSS score of 0.07% (22nd percentile), exploitation probability is assessed as low at time of analysis, and no public exploit or active exploitation has been identified.

Technical ContextAI

BIND (Berkeley Internet Name Domain) is the ISC reference implementation of the DNS protocol, widely deployed as an authoritative and recursive resolver on Linux distributions including Alpine Linux. Alpine Linux distributes BIND under its standard package management system (apk), with versioning following the upstream ISC release plus a release revision suffix (e.g., 9.20.15-r0). The 9.20.x branch is a current stable release series. No CWE classification is available in the provided data, so the root cause vulnerability class - whether memory safety, logic error, input validation, or resource exhaustion - cannot be confirmed from available intelligence.

Affected ProductsAI

Alpine Linux systems running ISC BIND versions prior to 9.20.15-r0 are affected per the Alpine Linux vendor advisory. The fix was introduced in Alpine package bind-9.20.15-r0. Specific upstream ISC BIND versions below 9.20.15, as well as any Alpine Linux release streams shipping older BIND packages, are potentially affected. No CPE strings were provided in the available intelligence. Exact Alpine Linux release branches (e.g., edge, v3.21) containing the vulnerable package have not been specified in available data.

RemediationAI

Upgrade the BIND package on Alpine Linux to version 9.20.15-r0 or later using the Alpine package manager: 'apk update && apk upgrade bind'. This is the vendor-confirmed fix per the Alpine Linux advisory. No workarounds or compensating controls are specified in available data because the vulnerability type is unknown - without knowing the attack vector or vulnerable component, specific mitigations cannot be responsibly prescribed. Until the full advisory is published, administrators of internet-exposed BIND resolvers or authoritative servers should prioritize patching, as BIND DNS infrastructure is historically a high-value target. No upstream ISC advisory URL was available in the provided intelligence data.