CVE-2025-40778: 
Rocky Linux vulnerability analysis and mitigation

A high-severity vulnerability (CVE-2025-40778) was discovered in BIND 9 DNS resolvers that allows attackers to inject forged data into the cache. The vulnerability affects BIND 9 versions ranging from 9.11.0 through 9.21.12 and their corresponding Supported Preview Editions. Under certain circumstances, BIND is too lenient when accepting records from answers, enabling attackers to inject forged data into the cache during DNS queries (ISC Advisory, NVD).

The vulnerability stems from a flaw in BIND 9's resolver logic where it fails to validate that answer-section RRsets match the question being resolved. The vulnerable logic allows additional A or CNAME records bundled in the answer section to be inserted into cache even if they relate to a different name. This breaks the assumption that off-path attackers must win a race on the exact tuple being asked and enables injection of arbitrary hostnames once a single subdomain query is spoofed. The vulnerability has been assigned a CVSS v3.1 score of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) (ISC Advisory, GitHub PoC).

The vulnerability enables attackers to redirect any domain reachable through the recursive resolver by injecting arbitrary A or CNAME records into cache. This can lead to credential theft, malware distribution, or man-in-the-middle attacks against downstream clients that trust the resolver. Because the attack is off-path and requires no authentication, widely deployed resolvers are at risk until patched (Help Net Security, GitHub PoC).

The vulnerability has been patched in BIND 9 versions 9.18.41, 9.20.15, and 9.21.14, and corresponding Supported Preview Edition versions. Until upgrades are complete, organizations are advised to restrict recursion to trusted clients, enable DNSSEC validation, monitor cache activity for unexpected records, and reduce maximum caching time to 24 hours or less. No other workarounds are known to be effective (ISC Advisory, Help Net Security).

According to Censys research, approximately 5,912 vulnerable instances were identified globally. The German Federal Office for Information Security (BSI) has issued guidance for DNS server operators, emphasizing the importance of immediate patching and implementing additional security measures (Censys Advisory, Help Net Security).