https://reddit.com/r/sysadmin/comments/1ogjvq9/critical_bind9_dns_cache_poisoning_vulnerability/: [Critical] BIND9 DNS Cache Poisoning Vulnerability CVE-2025-40778 - 706K+ Instances Affected, PoC Public

Q: Which deployments are most exposed to exploitation?

BIND9 resolver instances that permit recursion are the relevant target, particularly the reported 706,000+ exposed resolver instances. Restricting recursion to trusted clients with ACLs reduces exposure.

Q: Does an attacker need direct access to the resolver network?

No. The issue is described as exploitable by an off-path attacker, who can inject forged DNS records into resolver caches without direct network access.

Q: What mitigations are available if patching cannot happen immediately?

Restrict recursion to trusted clients using ACLs, enable DNSSEC validation, and monitor resolver cache contents for anomalies. Network scanning can also identify vulnerable instances that need remediation.

Q: How can administrators determine whether a resolver may be affected?

Check whether the deployment runs BIND 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, or 9.21.0 through 9.21.12. Scan the network for vulnerable resolver instances and inspect cache contents for anomalous records.

Published Oct 26, 2025

Updated

Affected Software

1 affected component

ISC BIND>=9.11.0<=9.16.50, >=9.18.0<9.18.39, >=9.20.0<9.20.13, >=9.21.0<9.21.12

Frequently Asked Questions

Which deployments are most exposed to exploitation?

BIND9 resolver instances that permit recursion are the relevant target, particularly the reported 706,000+ exposed resolver instances. Restricting recursion to trusted clients with ACLs reduces exposure.

Does an attacker need direct access to the resolver network?

No. The issue is described as exploitable by an off-path attacker, who can inject forged DNS records into resolver caches without direct network access.

What mitigations are available if patching cannot happen immediately?

Restrict recursion to trusted clients using ACLs, enable DNSSEC validation, and monitor resolver cache contents for anomalies. Network scanning can also identify vulnerable instances that need remediation.

How can administrators determine whether a resolver may be affected?

Check whether the deployment runs BIND 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, or 9.21.0 through 9.21.12. Scan the network for vulnerable resolver instances and inspect cache contents for anomalous records.