CVE-2025-40777

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-40777
If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://kb.isc.org/docs/cve-2025-40777
Configurations

No configuration.

History

17 Jul 2025, 21:15

Type Values Removed Values Added
Summary
  • (es) Si un solucionador de caché con nombre está configurado con `serve-stale-enable` `yes` y con `stale-answer-client-timeout` establecido en `0` (el único valor permitido aparte de `disabled`), y si el solucionador, al resolver una consulta, encuentra una cadena CNAME que involucra una combinación específica de registros en caché o autorizados, el daemon se interrumpirá con un error de aserción. Este problema afecta a las versiones de BIND 9 de la 9.20.0 a la 9.20.10, de la 9.21.0 a la 9.21.9 y de la 9.20.9-S1 a la 9.20.10-S1.

16 Jul 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-16 18:15

Updated : 2025-07-17 21:15

NVD link : CVE-2025-40777

Mitre link : CVE-2025-40777

CVE.ORG link : CVE-2025-40777

JSON object : View

Products Affected

No product.

CWE
CWE-617

Reachable Assertion