Loading story…
ISC disclosed CVE-2025-40777, a high-severity denial-of-service flaw in BIND 9 that can cause named to exit during recursive lookups when the resolver is configured as a caching resolver with serve-stale enabled and stale-answer-client-timeout 0. The bug is triggered by a specific CNAME resolution path involving stale cache behavior and can be exploited remotely against affected resolvers; authoritative-only deployments are not believed to be impacted. ISC assigned the issue CVSS 7.5 and CWE-617, said there was no known active exploitation, and identified affected releases as BIND 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and Supported Preview Edition builds.
Related BIND bug reports show the same configuration also caused stale RRsets in CNAME chains to be mishandled, with refresh queries missing or incomplete and logs incorrectly reporting stale-answer activity for records that were not yet stale. ISC said fixes and regression tests were prepared through its coordinated release process, with the vulnerability addressed in 9.20.11 and 9.21.10 and the stale-refresh bug later fixed in 9.20.12 and 9.21.11. As a workaround, ISC advised operators to upgrade or disable the vulnerable stale-answer settings until patched versions are deployed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
An ISC GitLab issue for CVE-2025-40777 recorded that fixes and regression tests had been prepared and merged as part of ISC's coordinated release process. The issue described a reproducible crash path involving `zemanta-nychi2.outbrain.org`, low-TTL data, and stale-answer refresh logic.
ISC published a knowledge base advisory for CVE-2025-40777 listing affected BIND 9.20.0-9.20.10 and 9.21.0-9.21.9 versions, stating authoritative services were believed unaffected. The advisory recommended upgrading to BIND 9.20.11 or 9.21.10 or disabling the vulnerable stale-answer settings as a workaround.
An ISC GitLab issue documented a bug where stale RRsets in a CNAME chain were not always refreshed correctly when `stale-answer-client-timeout` was set to 0. The report also noted misleading stale-answer log messages and identified BIND 9.18.33 and the bind-9.18 branch as affected.
ISC publicly disclosed CVE-2025-40777, a high-severity denial-of-service flaw in BIND resolvers tied to the use of `stale-answer-client-timeout 0`. The issue can cause `named` to crash during recursive lookups involving stale cache behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
gitlab.isc.org
Open sourcekb.isc.org
Open sourcegitlab.isc.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet Systems Consortium disclosed **nine vulnerabilities** in **BIND 9** and released patched versions **9.20.26** and **9.21.24**. The most severe issue, **`CVE-2026-13321`** (CVSS **8.6**), allows a remotely exploitable **DNSSEC validation bypass** by accepting signed **NSEC** records whose `Next Domain Name` points outside the signer’s zone, enabling cross-zone cache poisoning with authenticated denial responses. ISC also disclosed **`CVE-2026-11721`**, a high-severity **cache poisoning** flaw tied to label-count discrepancies in **RRSIG** and wildcard synthesis, and **`CVE-2026-10723`**, which can let attackers forge authenticated **NXDOMAIN** responses for sibling zones through incorrect acceptance of child-zone **NSEC3** records. ISC said no active exploitation was known at disclosure time and reported no workaround for the affected releases. The remaining flaws include several remotely exploitable **denial-of-service** and **resource exhaustion** bugs affecting DNSSEC-validating resolvers and other BIND components. **`CVE-2026-11622`** can drive memory consumption far beyond configured limits during random-subdomain attacks against DNSSEC-signed zones, while **`CVE-2026-11605`** can force excessive CPU use by making BIND validate unnecessary but valid **RRSIG** records. **`CVE-2026-13204`**, **`CVE-2026-12617`**, and **`CVE-2026-10822`** can cause **`named`** to exit unexpectedly under specific malformed or specially ordered DNS responses, and **`CVE-2026-11331`** can bypass wildcard **RPZ CNAME** policies and also trigger a crash with overly long query names. ISC advised users of affected **9.11**, **9.18**, **9.20**, **9.21**, and Supported Preview Edition branches to upgrade to the nearest patched supported release.
Jul 23, 2026
ISC disclosed **`CVE-2026-5947`**, a remotely exploitable use-after-free flaw in the BIND 9 recursive resolver that can crash the `named` process during **SIG(0)** signature validation. The bug stems from a race condition between asynchronous signature verification and recursive query cancellation when the `recursive-clients` quota is exhausted, allowing a `resquery_t` object to be freed while callback code still dereferences it. ISC rated the issue **CVSS 7.5** and said the demonstrated impact is denial of service, while arbitrary code execution is considered unlikely. The vulnerability affects BIND **9.20.0 through 9.20.22**, **9.21.0 through 9.21.21**, and **9.20.9-S1 through 9.20.22-S1**; the **9.18.x ESV** branch is not affected because it does not use the asynchronous SIG(0) verification path. According to ISC, no authentication is required, and exploitation is possible if an attacker controls an authoritative server or forwarder that returns SIG(0)-signed responses under query-flood conditions. Fixes were released in **9.20.23**, **9.21.22**, and **9.20.23-S1**, replacing the raw pointer handling with reference-counted attachment and corresponding detach logic.
Jul 10, 2026
**ISC disclosed a high-severity denial-of-service vulnerability in BIND 9** tracked as **CVE-2025-13878**, where remote attackers can crash the `named` daemon by sending specially crafted DNS traffic that triggers improper handling of malformed **BRID** and **HHIT** record data structures. The issue is remotely exploitable (no authentication or user interaction required) and is scored **CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)**, making publicly exposed DNS infrastructure a primary risk. The flaw affects both **authoritative name servers and DNS resolvers**, enabling an attacker to force a service outage by causing `named` to terminate unexpectedly. Reported affected versions include **BIND 9.18.40–9.18.43**, **9.20.13–9.20.17**, and **9.21.12–9.21.16**, with fixes available in **9.18.44**, **9.20.18**, and **9.21.17** (and corresponding *SPE* preview builds). The vulnerability was reported by **Vlatko Kosturjak (Marlink Cyber)**, and ISC issued early notification ahead of public disclosure, urging administrators to verify deployed versions and apply patched releases to prevent remote crash/DoS conditions.
Jun 29, 2026