Critical DNS Cache Poisoning Flaws Exposed in BIND Software

The makers of BIND, the Internet's most widely used software for resolving domain names, are warning of two vulnerabilities that allow attackers to poison entire caches of results and send users to malicious destinations that are indistinguishable from the real ones. The vulnerabilities, tracked as CVE-2025-40778 and CVE-2025-40780, stem from a logic error and a weakness in generating pseudo-random numbers, respectively. They each carry a severity rating of 8.6. According to the developers, the vulnerabilities can be exploited to cause DNS resolvers located inside thousands of organizations to replace valid results for domain lookups with corrupted ones. The corrupted results would replace the IP addresses controlled by the domain name operator with malicious ones controlled by the attacker. For instance, the IP address for arstechnica.com would be replaced with a malicious one. The BIND developers have attributed the vulnerabilities to a logic error and a weakness in generating pseudo-random numbers. "We take the security of our software very seriously, and we are working diligently to address these vulnerabilities," said a spokesperson for the BIND developers. "We urge all users to update to the latest version of BIND as soon as possible." Separately, makers of the Domain Name System resolver software Unbound warned of similar vulnerabilities that were reported by the same researchers. The Unbound vulnerability severity score is 5.6. "We are aware of the vulnerabilities in BIND and are working to address them in our own software," said a spokesperson for the Unbound developers. "We recommend that all users update to the latest version of Unbound to ensure their security." The vulnerabilities can have significant industry impact, as they can be exploited to cause widespread DNS cache poisoning. This can lead to users being redirected to malicious websites, compromising their security and potentially leading to further attacks. The researchers who discovered the vulnerabilities, a team of security experts, reported that the vulnerabilities can be exploited using a variety of methods, including exploiting the logic error in BIND's caching mechanism and using a weakness in the pseudo-random number generator to predict the cache keys. The BIND developers have released an update to address the vulnerabilities, and users are urged to update to the latest version as soon as possible. The Unbound developers are also working on an update to address the vulnerabilities in their software. The discovery of these vulnerabilities serves as a reminder of the importance of keeping software up to date and secure. As the Internet continues to evolve and become increasingly dependent on DNS, the need for secure and reliable DNS resolution software becomes more critical.