BIND 9 cache poisoning fixes on Debian: DSA-6033-1 (CVE-2025-40778, CVE-2025-40780)

On 23 October 2025 Debian released DSA-6033-1 for bind9 on Debian 12 (bookworm) and Debian 13 (trixie). It fixed three vulnerabilities that ISC had disclosed the day before: two that could let an attacker plant forged records in a resolver's cache, and one that could exhaust CPU. Debian summarised the impact as possible cache poisoning or denial of service.

Any system updated since then has these fixes, and later BIND updates have built on them. This note is for checking older or long-unpatched resolvers and for understanding why cache poisoning keeps coming back in DNS advisories.

At a glance

What the vulnerabilities are

All three affect BIND when it acts as a resolver. ISC says authoritative-only service is believed to be unaffected, but it also points out that authoritative servers sometimes make recursive queries, so check your configuration rather than assume.

Cache poisoning (CVSS 8.6 each)

• CVE-2025-40778: under certain circumstances BIND was too lenient when accepting records from answers, so an attacker could inject forged data into the cache. Forged records can then affect the resolution of later queries.
• CVE-2025-40780: a weakness in the pseudo-random number generator BIND used made it possible, in specific circumstances, to predict the source port and query ID of outgoing queries. Those two values are what make blind spoofing hard, so predicting them can let spoofed responses be cached.

CPU exhaustion (CVSS 7.5)

• CVE-2025-8677: querying records in a specially crafted zone that contains certain malformed DNSKEY records can lead to CPU exhaustion and a denial of service for legitimate clients.

ISC listed no workarounds and said it was not aware of active exploits. None of the three is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition). The CISA enrichment on the CVE record for CVE-2025-40778 does mark exploitation as "poc", meaning a proof of concept was publicly known, which is one more reason not to leave old resolvers unpatched.

Are you affected?

Check the installed version and whether BIND is running:

dpkg-query -W -f='${Package} ${Version}\n' 'bind9*'
apt policy bind9
systemctl is-active named

Bookworm builds older than 1:9.18.41-1~deb12u1 and trixie builds older than 1:9.20.15-1~deb13u1 are affected. Also check whether the server resolves names for anyone at all:

sudo named-checkconf -px | grep -nE 'recursion|allow-recursion|allow-query-cache'

An authoritative-only server should normally say recursion no;.

How to update

Install the newest bind9 packages for your release. That brings in this fix and every later one:

sudo apt update
sudo apt install --only-upgrade bind9 bind9-libs bind9-utils bind9-dnsutils bind9-host
apt policy bind9

As of 31 October 2026 the newest builds are 1:9.20.30-1~deb13u1 on trixie and 1:9.18.49-1~deb12u3 on bookworm. Bullseye's LTS period ended on 31 August 2026, so a bullseye BIND server should be moved to a supported release rather than patched in place.

Restart or reboot?

Restart the service so the patched named is running. No reboot is needed. Restarting also empties the resolver cache, which is sensible if you suspect the cache was ever poisoned:

sudo systemctl restart named
named -v

To clear the cache without a restart, sudo rndc flush does the same job.

Sources

• security-tracker.debian.org/tracker/DSA-6033-1
• debian.org/security/2025/dsa-6033
• lists.debian.org/debian-security-announce/2025/msg00199.html
• security-tracker.debian.org/tracker/DLA-4364-1
• lists.debian.org/debian-lts-announce/2025/11/msg00007.html
• security-tracker.debian.org/tracker/bind9
• kb.isc.org/docs/cve-2025-40778
• kb.isc.org/docs/cve-2025-40780
• kb.isc.org/docs/cve-2025-8677
• kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries
• cve.org/CVERecord?id=CVE-2025-40778
• cve.org/CVERecord?id=CVE-2025-40780
• cisa.gov/known-exploited-vulnerabilities-catalog
• manpages.debian.org/trixie/bind9-utils/named-checkconf.1.en.html
• debian.org/releases
• bind9.readthedocs.io/en/v9.20.30/reference.html