1. Home
  2. Vulnerabilities
  3. CVE-2025-40778
8.6
HIGH CVSS 3.1
CVE-2025-40778
Cache poisoning attacks with unsolicited RRs
Description

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

INFO

Published Date :

Oct. 22, 2025, 4:15 p.m.

Last Modified :

Nov. 4, 2025, 10:16 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
Affected Products

The following products are affected by CVE-2025-40778 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Isc bind
: Total Affected Vendor : 1 | Products : 1
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH [email protected]
Solution
Update BIND to a patched version to prevent cache poisoning by validating DNS records.
  • Update BIND to a secure version.
  • Apply vendor-provided security patches.
  • Validate DNS record acceptance rules.
  • Monitor cache for forged data.
Public PoC/Exploit Available at Github

CVE-2025-40778 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-40778.

URL Resource
https://kb.isc.org/docs/cve-2025-40778
http://www.openwall.com/lists/oss-security/2025/10/22/1
https://gist.github.com/N3mes1s/f76b4a606308937b0806a5256bc1f918
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-40778 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-40778 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
nehkark/CVE-2025-40778

POC CVE-2025-40778: Cache Poisoning BIND 9 👾

Python

Updated: 6 days, 10 hours ago
4 stars 1 fork 1 watcher
Born at : Oct. 29, 2025, 4:05 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
w4zu/Debian_security

DSA and DLA for Debian last 14 days

Python

Updated: 7 hours, 38 minutes ago
0 stars 0 fork 0 watcher
Born at : Feb. 12, 2025, 2:08 p.m. This repo has been linked 69 different CVEs too.
Profile Photo
runwhen-contrib/helm-charts

All Public RunWhen Helm Charts - Managed by terraform

Smarty Shell Dockerfile

Updated: 4 hours, 52 minutes ago
1 stars 0 fork 0 watcher
Born at : Sept. 18, 2023, 10:09 a.m. This repo has been linked 67 different CVEs too.
Profile Photo
nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 7 hours, 20 minutes ago
7367 stars 1215 fork 1215 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 829 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-40778 vulnerability anywhere in the article.

  • security.nl
'Duizenden dns-servers missen belangrijke update voor BIND 9-lekken

Duizenden dns-servers die op BIND 9 draaien, waaronder zo'n honderd in Nederland, missen een beveiligingsupdate voor twee belangrijke beveiligingslekken die cache-poisoning mogelijk maken. Dat laat Th ... Read more

Published Date: Nov 03, 2025 (3 days, 15 hours ago)
  • Help Net Security
Week in review: WSUS vulnerability exploited to drop Skuld infostealer, PoC for BIND 9 DNS flaw published

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Can your earbuds recognize you? Researchers are working on it Biometric authentication has moved from ... Read more

Published Date: Nov 02, 2025 (4 days, 17 hours ago)
  • The Hacker News
ThreatsDay Bulletin: DNS Poisoning Flaw, Supply-Chain Heist, Rust Malware Trick and New RATs Rising

The comfort zone in cybersecurity is gone. Attackers are scaling down, focusing tighter, and squeezing more value from fewer, high-impact targets. At the same time, defenders face growing blind spots ... Read more

Published Date: Oct 30, 2025 (1 week ago)
  • CybersecurityNews
PoC Exploit Released for BIND 9 Vulnerability that Let Attackers Forge DNS Records

A public exploit code demonstrating how attackers could exploit CVE-2025-40778, a critical vulnerability in BIND 9 that enables DNS cache poisoning. The Internet Systems Consortium (ISC) initially dis ... Read more

Published Date: Oct 29, 2025 (1 week, 1 day ago)
  • The Cyber Express
Apache Warns of Critical Tomcat Vulnerabilities Impacting Versions 9, 10, and 11

The Apache Software Foundation has disclosed two new security vulnerabilities affecting multiple versions of Apache Tomcat, warning system administrators to take immediate action. The flaws, identifie ... Read more

Published Date: Oct 29, 2025 (1 week, 1 day ago)
  • The Cyber Express
CISA Warns that DELMIA Apriso Vulnerabilities Are Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two DELMIA Apriso vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Today’s addition of CVE-2025-6204 and ... Read more

Published Date: Oct 28, 2025 (1 week, 2 days ago)
  • Help Net Security
PoC code drops for remotely exploitable BIND 9 DNS flaw (CVE-2025-40778)

A high-severity vulnerability (CVE-2025-40778) affecting BIND 9 DNS resolvers could be leveraged by remote, unauthenticated attackers to manipulate DNS entries via cache poisoning, allowing them to re ... Read more

Published Date: Oct 28, 2025 (1 week, 2 days ago)
  • The Cyber Express
Critical Flaw CVE-2025-55315 Exposes QNAP NetBak PC Agent to Security Bypass Attacks

A critical vulnerability, tracked as CVE-2025-55315, has been identified in QNAP’s NetBak PC Agent, stemming from a flaw within Microsoft’s ASP.NET Core framework. The issue allows attackers to exploi ... Read more

Published Date: Oct 28, 2025 (1 week, 2 days ago)
  • The Cyber Express
New BIND 9 Security Flaw (CVE-2025-40778) Threatens Global DNS Infrastructure

A newly disclosed security flaw has put more than 706,000 BIND 9 DNS resolvers worldwide at risk of cache poisoning attacks, according to an advisory published by the Internet Systems Consortium (ISC) ... Read more

Published Date: Oct 27, 2025 (1 week, 3 days ago)
  • security.nl
NCSC verwacht misbruik van kwetsbaarheden in dns-software BIND 9

Het Nationaal Cyber Security Centrum (NCSC) verwacht dat aanvallers misbruik zullen maken van verschillende kwetsbaarheden in dns-serversoftware BIND 9, waardoor cache-poisoning mogelijk is en gebruik ... Read more

Published Date: Oct 27, 2025 (1 week, 3 days ago)
  • CybersecurityNews
706,000+ BIND 9 Resolver Instances Vulnerable to Cache Poisoning Exposed Online – PoC Released

A high-severity vulnerability in BIND 9 resolvers has been disclosed, potentially allowing attackers to poison caches and redirect internet traffic to malicious sites. Tracked as CVE-2025-40778, the f ... Read more

Published Date: Oct 26, 2025 (1 week, 4 days ago)
  • CybersecurityNews
Multiple BIND 9 DNS Vulnerabilities Enable Cache Poisoning and Denial of Service Attacks

The Internet Systems Consortium (ISC) disclosed three high-severity vulnerabilities in BIND 9 on October 22, 2025, potentially allowing remote attackers to conduct cache poisoning attacks or cause den ... Read more

Published Date: Oct 23, 2025 (2 weeks ago)
  • Daily CyberSecurity
ISC Patches Multiple High-Severity BIND Vulnerabilities Enabling Cache Poisoning and Denial of Service Attacks

The Internet Systems Consortium (ISC) has issued patches for three high-severity vulnerabilities impacting the BIND 9 DNS server, including two that could enable cache poisoning attacks (CVE-2025-4077 ... Read more

Published Date: Oct 23, 2025 (2 weeks ago)
  • Ars Technica
Cache poisoning vulnerabilities found in 2 DNS resolving apps

GONNA POISON LIKE IT’S 2008 At least one CVE could weaken defenses put in place following 2008 disclosure. The makers of BIND, the Internet’s most widely used software for resolving domain names, are ... Read more

Published Date: Oct 22, 2025 (2 weeks, 1 day ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-40778 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 04, 2025

    Action Type Old Value New Value
    Added Reference http://www.openwall.com/lists/oss-security/2025/10/22/1
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 27, 2025

    Action Type Old Value New Value
    Added Reference https://gist.github.com/N3mes1s/f76b4a606308937b0806a5256bc1f918
  • New CVE Received by [email protected]

    Oct. 22, 2025

    Action Type Old Value New Value
    Added Description Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
    Added CWE CWE-349
    Added Reference https://kb.isc.org/docs/cve-2025-40778
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 8.6
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact