CVE-2025-40777: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-40777 is a reachable assertion vulnerability in ISC BIND 9 that can cause the named daemon to abort with an assertion failure, resulting in a denial of service. It affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1. The vulnerability was publicly disclosed by ISC on July 16, 2025, with fixed versions released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, ISC KB).

The root cause is a reachable assertion (CWE-617) in the BIND 9 caching resolver's stale answer handling logic. The vulnerability is triggered when named is configured with both serve-stale-enable yes and stale-answer-client-timeout 0, and the resolver encounters a CNAME chain involving a specific combination of cached or authoritative records during query resolution. This combination causes an internal assertion to fail, crashing the daemon. The attack is network-based, requires no authentication or user interaction, and has low complexity, making it straightforward to trigger remotely (ISC KB, oss-security).

Successful exploitation causes the named daemon to crash, resulting in a complete loss of DNS resolution availability for all clients relying on the affected resolver. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Organizations running affected BIND versions as caching resolvers with the specific stale-answer configuration could experience DNS outages, potentially disrupting dependent services and applications (Red Hat Advisory, ISC KB).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. Exploitation requires the target resolver to be configured with both serve-stale-enable yes and stale-answer-client-timeout 0, which limits the attack surface to specifically configured deployments (Red Hat Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible BIND 9 caching resolvers running versions 9.20.0–9.20.10, 9.21.0–9.21.9, or 9.20.9-S1–9.20.10-S1 using tools like Shodan or Censys, or by querying version information via DNS (dig chaos txt version.bind @<target>).
2. Verify configuration: Confirm the target resolver has serve-stale-enable yes and stale-answer-client-timeout 0 in its configuration — this is a prerequisite for the vulnerability to be triggerable.
3. Craft a triggering CNAME chain: Construct a DNS query that causes the resolver to follow a CNAME chain involving a specific combination of cached and authoritative records that triggers the internal assertion failure. The exact chain structure is not publicly documented in detail.
4. Send the query: Submit the crafted DNS query to the target resolver. If the conditions are met, the named daemon will abort with an assertion failure, causing a denial of service.
5. Confirm impact: Verify that the resolver is unresponsive to subsequent DNS queries, confirming the crash (ISC KB, oss-security).

• Logs: Unexpected named process termination messages in system logs (e.g., /var/log/syslog, /var/log/messages) with assertion failure details; BIND logs showing INSIST or REQUIRE assertion failures referencing CNAME resolution code paths.
• Process: Sudden absence of the named process; automatic restarts of the BIND service by systemd or init systems.
• Network: Unusual DNS queries targeting the resolver with CNAME-heavy responses or chains from external authoritative servers immediately preceding a crash; DNS resolution failures reported by clients.
• File System: Core dump files generated by the named process in the working directory (if core dumps are enabled), which may contain assertion failure stack traces useful for forensic analysis.

ISC released patched versions BIND 9.20.11 and 9.21.10 on July 16, 2025; upgrading to these versions is the recommended remediation. Individual vulnerability-specific patches are also available in the patches/ subdirectory of each release at https://downloads.isc.org/isc/bind9/9.20.11/patches/ and https://downloads.isc.org/isc/bind9/9.21.10/patches/. As an immediate workaround, administrators can set stale-answer-client-timeout disabled or remove the serve-stale-enable yes configuration to eliminate the vulnerable code path without upgrading (ISC KB, oss-security).

ISC disclosed the vulnerability via the oss-security mailing list on July 16, 2025, alongside the release of patched versions. Multiple Linux distributions including Ubuntu, SUSE, Slackware, and openSUSE issued security advisories and updated packages promptly. Security news outlets including GBHackers, CyberSecurityNews, and SecurityOnline.info covered the disclosure, often pairing it with the related CVE-2025-40776 (cache poisoning) in BIND 9. The Canadian Centre for Cyber Security (CCCS) also issued advisory AV25-440 referencing the vulnerability (oss-security, CCCS Advisory, SecurityOnline).