Security researchers have discovered 14 vulnerabilities in BIND 9, the widely used DNS server by Internet Systems Consortium (ISC), that could enable attackers to corrupt DNS resolver caches, crash exposed servers remotely, exhaust their resources, or bypass crucial DNSSEC protections. Administrators operating public-facing or recursive BIND resolvers are urged to update to patched releases immediately to mitigate substantial risks.
Main Vulnerabilities Explained
Two of the most worrying flaws enable cache-poisoning. One, CVE-2025-40778, involves spoofing weaknesses allowing forged records to be injected into a resolver cache when DNSSEC is disabled or validation is turned off. Another, CVE-2025-40780, affects BIND’s old pseudo-random number generator for UDP source port and transaction ID prediction—weaknesses that attackers can exploit to increase success rates for fake responses. In response, ISC has replaced the legacy generator with a cryptographically secure PRNG.
Other flaws include severe remote denial-of-service (DoS) weaknesses. For example, CVE-2026-5947 deals with crashes triggered by SIG(0)-signed responses under load. CVE-2026-3593 highlights a use-after-free bug in BIND’s DNS-over-HTTPS (DoH) feature, which malicious HTTP/2 SETTINGS frames can exploit while a DNS response is being processed. Additional vulnerabilities stem from malformed DNSSEC records, CNAME/DNAME mis-handling, problematic DNS64 logic, and malformed zone transfers or NSEC/NSEC3 responses.
Severity & Affected Components
The 14 vulnerabilities are all categorized as “High” severity. Components impacted span TSIG parsing, recursive resolver logic, resolver cache, UDP randomization, DNSSEC validation (including DNSKEY and NSEC3), TKEY processing, SIG(0) authentication, and features such as resolver server lists, DoH, non-IN DNS views, and bad-server handling. The breadth of affected modules suggests both careful internal review and broad exposure risk.
ISC’s update also introduces protections against resource-exhaustion attacks. New limits have been added to safeguard against excessive DNSSEC validation effort, bloated name server lists, negative response amplification, HTTPSSVCB alias misuse, and uncontrolled cache growth. Such modifications seek to prevent attacks that could degrade or halt DNS service for legitimate users.
What Administrators Should Do
Operators should first identify all BIND instances in their infrastructure, especially recursive resolvers exposed to the public, DNS-over-HTTPS endpoints, and DNSSEC validating servers. They should also check for usage of DNS64, zone transfers, response policy zones, and dynamic updates as these functions are among those impacted.
Then, upgrade to the latest supported BIND release that includes patches for all disclosed flaws. Restrict recursion to trusted clients, monitor logs for mysterious restarts or errors associated with malformed queries, and watch for abnormal resource usage (CPU, memory) as indicators of exploitation.
These flaws make clear that DNS infrastructure remains a high-priority target. Cache-poisoning attacks risk redirecting users to malicious or fraudulent sites without detection, and remote crashes or downtime can interrupt critical network services.
What this reveals is a double challenge: DNS software must remain both robust and adaptive. ISC’s fixes close immediate vulnerabilities, but administrators must stay ahead by enforcing strict validation, minimizing external exposure, and keeping up with patches. In an era where trust in DNS underpins everything from financial transactions to critical infrastructure, overlooking such fixes isn’t just about network stability—it’s about maintaining the integrity of internet trust itself.
