Red Hat Security Advisory

RHSA-2025:21817

bind security update

Released 2025-11-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.4) bind-devel-32:9.16.23-18.el9_4.10, bind-doc-32:9.16.23-18.el9_4.10, bind-libs-32:9.16.23-18.el9_4.10
Red Hat Enterprise Linux AppStream EUS (v.9.4) bind-32:9.16.23-18.el9_4.10, bind-chroot-32:9.16.23-18.el9_4.10, bind-dnssec-doc-32:9.16.23-18.el9_4.10 +5

Fixes 2 records

TI-2025-27240 CVE-2025-40778 · GHSA-xmqp-6cj2-2hh3

Cache poisoning attacks with unsolicited RRs

HIGH 76

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00667 Published 2025-10-22 Fixed CWE-349

TI-2025-27242 CVE-2025-40780 · GHSA-j3w4-m6qj-vmm5

Cache poisoning due to weak PRNG

MEDIUM 44

In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00466 Published 2025-10-22 Fixed CWE-341