The Internet Systems Consortium has issued critical updates for BIND 9, addressing 14 vulnerabilities that expose systems to DNS cache poisoning and remote server crashes. These flaws could be exploited to deplete server resources or bypass DNSSEC protections, posing significant risks to enterprise, ISP, and cloud environments.
Urgent Recommendations for Administrators
Administrators managing recursive BIND resolvers are urged to implement the latest updates promptly. The most severe vulnerabilities impact the named daemon, a crucial component for both authoritative and recursive DNS services. Left unpatched, these issues could severely disrupt operations.
Several vulnerabilities can be exploited through malicious DNS responses or specially crafted client queries, making internet-facing resolvers particularly vulnerable. This highlights the need for immediate action to secure these systems.
Threat of DNS Cache Poisoning
Among these vulnerabilities, two are directly linked to DNS cache-poisoning threats. CVE-2025-40778 is notable for its spoofing weaknesses, enabling attackers to inject forged records into a resolver cache when DNSSEC is not enabled or validation is disabled. As a countermeasure, ISC has modified BIND to reject DNAME and unnecessary NS records unless received through spoofing-resistant channels, such as TCP or DNS Cookies.
Another critical issue, CVE-2025-40780, stems from BIND’s previous pseudo-random number generator, which could allow attackers to predict UDP ports and DNS transaction IDs, facilitating cache poisoning. ISC has replaced this with a cryptographically secure generator to fortify against such attacks.
Denial-of-Service Vulnerabilities
Multiple fixes target remote denial-of-service vulnerabilities, including CVE-2026-5947, which causes crashes from SIG(0)-signed responses under load, and CVE-2026-3593, a flaw in DNS-over-HTTPS that could be triggered by a flood of HTTP/2 SETTINGS frames. This could cause the named process to crash while writing a DNS response.
Additional flaws were identified, leading to process termination during TKEY processing, handling of malformed DNSSEC records, and other operations. These vulnerabilities highlight the importance of securing authoritative domains and DNS servers against malformed records that could cause assertion failures and resolver crashes.
Organizations must assess all systems running BIND, particularly those utilizing public recursive resolvers, DNS-over-HTTPS endpoints, or DNSSEC-validating resolvers. Upgrading to a supported BIND release and monitoring for unusual activity is essential to maintaining security.
These updates underscore the critical nature of DNS infrastructure as a target for attacks. Successful cache-poisoning can redirect users to malicious sites, while remote crashes could disrupt vital network services. Proactively addressing these vulnerabilities is crucial to safeguarding network integrity.
