CVE-2025-13878

CWE-617 — Reachable AssertionCWE-12868 documents7 sources
Severity
7.5HIGH
EPSS
0.0%
top 86.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
ISC Bind 9
Timeline
PublishedJan 21

Description

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Alpinebind< 9.18.44-r0+4
▶Debianbind9< 1:9.18.44-1~deb12u1+2
▶CVEListV5isc/bind_99.18.40 — 9.18.43+4

🔴Vulnerability Details

4
GHSA
GHSA-p5qx-fwf5-q388: Malformed BRID/HHIT records can cause `named` to terminate unexpectedly↗2026-01-21
▶
OSV
CVE-2025-13878: Malformed BRID/HHIT records can cause `named` to terminate unexpectedly↗2026-01-21
▶
OSV
CVE-2025-13878: Malformed BRID/HHIT records can cause `named` to terminate unexpectedly↗2026-01-21
▶
CVEList
Malformed BRID/HHIT records can cause named to terminate unexpectedly↗2026-01-21
▶

📋Vendor Advisories

2
Red Hat
bind: bind: Denial of Service via corrupt or malicious record↗2026-01-21
▶
Debian
CVE-2025-13878: bind9 - Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This is...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-13878 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶