BIND 9 Vulnerability Allow Attackers to Crash Server by Sending Malicious Records

A high-severity vulnerability has been disclosed in BIND 9, the widely used DNS server software that resolves domain names for millions of internet services.

The vulnerability, tracked as CVE-2025-13878, enables remote attackers to crash DNS servers by sending specially crafted, malformed DNS records, potentially disrupting critical internet infrastructure and organizational services.

The vulnerability stems from improper handling of malformed BRID (Breadth-first Record ID) and HHIT (Host Hash Information Table) records within BIND 9’s named daemon.

When a DNS server receives a request containing corrupted or malicious records of these types, the daemon terminates unexpectedly, causing a complete service outage.

This denial-of-service (DoS) condition affects both authoritative nameservers and DNS resolvers, expanding the attack surface across diverse network architectures.

The vulnerability carries a CVSS v3.1 severity score of 7.5 (High), with an attack vector rated as Network-based, requiring no special privileges or user interaction.

This accessibility makes the flaw particularly concerning for publicly accessible DNS infrastructure.

ISC disclosed this vulnerability publicly on January 21, 2026, following an early notification issued on January 14, 2026. The advisory recommends upgrading to the latest patched versions.

Notably, no active exploits are currently documented in the wild, providing organizations a critical window for proactive remediation before potential exploitation campaigns emerge.

Currently, no workarounds exist, making patching the only viable mitigation strategy. Organizations running BIND 9 should prioritize updating to the latest patched versions in their respective branches.

ISC acknowledges the security researcher for responsibly disclosing this vulnerability, demonstrating the continued importance of coordinated vulnerability reporting.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.