Critical BIND 9 Vulnerabilities Allow Cache Poisoning, DoS

Key Takeaways

• Internet Systems Consortium (ISC) has released patches for 14 critical vulnerabilities affecting BIND 9.
• The flaws could enable DNS cache poisoning, remote denial-of-service, resource exhaustion, and DNSSEC bypasses.
• All BIND 9 deployments, especially internet-facing recursive resolvers, are at risk.
• Immediate application of the latest security updates is strongly recommended.

The Internet Systems Consortium (ISC) has issued a significant security advisory concerning 14 newly identified vulnerabilities in its widely used BIND 9 DNS software. These critical flaws could allow malicious actors to compromise DNS integrity through cache poisoning, trigger remote denial-of-service (DoS) attacks, exhaust server resources, or circumvent DNSSEC security measures.

System administrators managing BIND recursive resolvers are urged to prioritize the installation of the recently released patched versions. The most severe of these issues impact the named daemon, a core component responsible for delivering authoritative and recursive DNS services across a broad spectrum of environments, including enterprise networks, internet service providers (ISPs), and cloud infrastructure.

Many of these vulnerabilities can be exploited through crafted DNS responses or specially designed client queries, making internet-accessible resolvers particularly vulnerable to attack.

BIND DNS Servers Face Widespread Security Threats

Cache Poisoning Risks Addressed

Among the critical vulnerabilities are two directly related to DNS cache poisoning. CVE-2025-40778 highlights multiple spoofing weaknesses that could permit attackers to inject forged records into a resolver’s cache, especially when DNSSEC is not active or its validation is disabled. To counter this, ISC has modified BIND to reject DNAME records or superfluous NS records in the authority section unless the response originates from a spoofing-resistant mechanism, such as TCP, DNS Cookies, TSIG, or SIG(0).

Additionally, CVE-2025-40780 targets the former pseudo-random number generator (PRNG) employed by BIND. This flaw could potentially allow attackers to predict UDP ports and DNS transaction IDs, thereby increasing the success rate of forged DNS responses. ISC has since replaced this PRNG with a cryptographically secure equivalent, significantly increasing the difficulty of prediction-based cache poisoning attacks.

Denial-of-Service and Resource Exhaustion Vulnerabilities

Several patches address various remote denial-of-service scenarios. This includes CVE-2026-5947, which can lead to crashes when processing SIG(0)-signed responses under heavy load, and CVE-2026-3593, a use-after-free vulnerability affecting DNS-over-HTTPS (DoH). The DoH issue could be triggered by an influx of HTTP/2 SETTINGS frames while BIND is in the process of writing a DNS response, potentially causing the named daemon to crash.

Other identified flaws could lead to BIND termination during TKEY processing, handling of malformed DNSSEC records, CNAME and DNAME operations, DNS64 processes, zone transfers, or when confronted with specially constructed NSEC and NSEC3 responses.

In certain situations, an attacker with control over an authoritative domain or DNS server could deliver malformed records. These records might trigger an assertion failure, causing the resolver process to unexpectedly exit.

The advisory also introduces new protections against resource exhaustion. ISC has implemented limits to prevent excessive DNSSEC validation tasks, mitigate issues with unusually large nameserver lists, counter crafted negative responses, manage HTTPSSVCB alias processing, and control cache growth. Without these protections, such attacks could consume significant CPU or memory resources, leading to delays in legitimate DNS lookups and impacting service availability.

What You Should Do

• Identify Affected Systems: Pinpoint all systems running BIND, with particular attention to public recursive resolvers, DNS-over-HTTPS endpoints, DNSSEC-validating resolvers, and servers utilizing DNS64, response policy zones, or dynamic updates.
• Upgrade Immediately: Upgrade to a supported BIND release containing the fixes as soon as possible.
• Review Resolver Exposure: Assess and minimize the public exposure of your resolvers.
• Restrict Recursion: Configure resolvers to restrict recursion to only trusted client networks.
• Monitor Logs: Regularly monitor BIND logs for any signs of unexpected named restarts, errors related to malformed queries, or abnormal CPU and memory usage patterns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.