CVE-2025-40776

HIGH

BIND 9 9.11.3-S1-9.16.50-S1, 9.18.11-S1-9.18.37-S1, 9.20.9-S1-9.20.10-S1 - Cache Poisoning via ECS Option Handling

Title source: llm
STIX 2.1

Description

A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack. This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.

References (1)

Core 1
Core References
Various Sources vendor-advisory
https://kb.isc.org/docs/cve-2025-40776

Scores

CVSS v3 8.6
EPSS 0.0005
EPSS Percentile 15.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-349
Status published
Products (4)
ISC/BIND 9 9.0.0 - 9.20.10
ISC/BIND 9 9.11.3-S1 - 9.16.50-S1
ISC/BIND 9 9.18.11-S1 - 9.18.37-S1
ISC/BIND 9 9.20.9-S1 - 9.20.10-S1
Published Jul 16, 2025
Tracked Since Feb 18, 2026