CVE-2025-40780
published 2025-10-22CVE-2025-40780: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source…
PriorityP352high8.6CVSS 3.1
AVNACLPRNUINSCCNIHAN
EPSS
0.46%
37.4th percentile
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.
This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | bind9 | < bind9 1:9.18.41-1~deb12u1 (bookworm) | bind9 1:9.18.41-1~deb12u1 (bookworm) |
| isc | bind | >= 0 < 9.18.41-r0 | 9.18.41-r0 |
| isc | bind | >= 0 < 9.18.41-r0 | 9.18.41-r0 |
| isc | bind | >= 0 < 9.18.41-r0 | 9.18.41-r0 |
| isc | bind | >= 0 < 9.20.15-r0 | 9.20.15-r0 |
| isc | bind | >= 0 < 9.20.15-r0 | 9.20.15-r0 |
| isc | bind9 | >= 0 < 1:9.16.50-1~deb11u4 | 1:9.16.50-1~deb11u4 |
| isc | bind9 | >= 0 < 1:9.18.41-1~deb12u1 | 1:9.18.41-1~deb12u1 |
| isc | bind9 | >= 0 < 1:9.20.15-1~deb13u1 | 1:9.20.15-1~deb13u1 |
| isc | bind9 | >= 0 < 1:9.20.15-1 | 1:9.20.15-1 |
| isc | bind9 | >= 0 < 1:9.18.39-0ubuntu0.22.04.2 | 1:9.18.39-0ubuntu0.22.04.2 |
| isc | bind9 | >= 0 < 1:9.18.39-0ubuntu0.24.04.2 | 1:9.18.39-0ubuntu0.24.04.2 |
| isc | bind9 | >= 0 < 1:9.20.11-1ubuntu2.1 | 1:9.20.11-1ubuntu2.1 |
| isc | bind9 | >= 0 < 1:9.18.30-0ubuntu0.20.04.2+esm1 | 1:9.18.30-0ubuntu0.20.04.2+esm1 |
| isc | bind_9 | 9.16.0 – 9.16.50 | — |
| isc | bind_9 | 9.16.8-S1 – 9.16.50-S1 | — |
| isc | bind_9 | 9.18.0 – 9.18.39 | — |
| isc | bind_9 | 9.18.11-S1 – 9.18.39-S1 | — |
| isc | bind_9 | 9.20.0 – 9.20.13 | — |
| isc | bind_9 | 9.20.9-S1 – 9.20.13-S1 | — |
| isc | bind_9 | 9.21.0 – 9.21.12 | — |
| msrc | azl3_bind_9.20.11-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_bind_9.20.15-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_bind_9.16.50-2_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
osv8.6HIGH
vendor_debian8.6HIGH
vendor_msrc8.6HIGH
vendor_redhat8.6HIGH
vendor_ubuntu8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
bind9 vulnerabilities
osv·2025-11-12·CVSS 8.6
CVE-2025-8677 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
USN-7836-1 fixed vulnerabilities in Bind. This update provides the
corresponding fixes for Ubuntu 20.04 LTS.
Original advisory details:
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service.
(CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack.
(CVE-2025-40778)
Amit Klein and Omer Ben Simhon discovered that Bind used a weak PRNG. A
remote attacker could possibly use this issue to perform a cache poisoning
attack. (CVE-2025-40780)
OSV
CVE-2025-40780: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the
osv·2025-10-22·CVSS 8.6
CVE-2025-40780 [HIGH] CVE-2025-40780: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.
This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
OSV
bind9 vulnerabilities
osv·2025-10-22·CVSS 8.6
CVE-2025-8677 [HIGH] bind9 vulnerabilities
bind9 vulnerabilities
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service.
(CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack.
(CVE-2025-40778)
Amit Klein and Omer Ben Simhon discovered that Bind used a weak PRNG. A
remote attacker could possibly use this issue to perform a cache poisoning
attack. (CVE-2025-40780)
OSV
CVE-2025-40780: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the
osv·2025-10-22·CVSS 8.6
CVE-2025-40780 [HIGH] CVE-2025-40780: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
GHSA
GHSA-j3w4-m6qj-vmm5: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the
ghsa_unreviewed·2025-10-22
CVE-2025-40780 [HIGH] CWE-341 GHSA-j3w4-m6qj-vmm5: In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.
This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2025-11-12·CVSS 8.6
CVE-2025-40780 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
USN-7836-1 fixed vulnerabilities in Bind. This update provides the
corresponding fixes for Ubuntu 20.04 LTS.
Original advisory details:
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service.
(CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack.
(CVE-2025-40778)
Amit Klein and Omer Ben Simhon discovered that Bind used a weak PRNG. A
remote attacker could possibly use this issue to
Red Hat
bind: Cache poisoning due to weak PRNG
vendor_redhat·2025-10-22·CVSS 8.6
CVE-2025-40780 [HIGH] CWE-338 bind: Cache poisoning due to weak PRNG
bind: Cache poisoning due to weak PRNG
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.
This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator (PRNG). This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS responses into the resolver’s cache, caus
Ubuntu
Bind vulnerabilities
vendor_ubuntu·2025-10-22·CVSS 8.6
CVE-2025-40778 [HIGH] Bind vulnerabilities
Title: Bind vulnerabilities
Summary: Several security issues were fixed in Bind.
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service.
(CVE-2025-8677)
Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that Bind
incorrectly accepted certain records from answers. A remote attacker could
possibly use this issue to perform a cache poisoning attack.
(CVE-2025-40778)
Amit Klein and Omer Ben Simhon discovered that Bind used a weak PRNG. A
remote attacker could possibly use this issue to perform a cache poisoning
attack. (CVE-2025-40780)
Instructions: In general, a standard system update will make all the necessary change
Microsoft
Cache poisoning due to weak PRNG
vendor_msrc·2025-10-14·CVSS 8.6
CVE-2025-40780 [HIGH] CWE-341 Cache poisoning due to weak PRNG
Cache poisoning due to weak PRNG
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
isc: isc
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/
Debian
CVE-2025-40780: bind9 - In specific circumstances, due to a weakness in the Pseudo Random Number Generat...
vendor_debian·2025·CVSS 8.6
CVE-2025-40780 [HIGH] CVE-2025-40780: bind9 - In specific circumstances, due to a weakness in the Pseudo Random Number Generat...
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Scope: local
bookworm: resolved (fixed in 1:9.18.41-1~deb12u1)
bullseye: resolved (fixed in 1:9.16.50-1~deb11u4)
forky: resolved (fixed in 1:9.20.15-1)
sid: resolved (fixed in 1:9.20.15-1)
trixie: resolved (fixed in 1:9.20.15-1~deb13u1)
No detection rules found.
No public exploits indexed.
2025-10-22
Published