Security flaws in a widely used DNS software threaten millions of clients with cache poisoning attacks.
Recent security advisories have revealed two critical vulnerabilities in BIND, a widely used DNS resolver software, triggering renewed concern about DNS cache poisoning attacks that many believe have been largely mitigated since 2008.
DNS cache poisoning, also known as DNS spoofing, is a technique where attackers inject forged DNS data into the caches of vulnerable resolvers. This causes users to unknowingly connect to fraudulent sites, exposing them to phishing, data theft, and malware risks. Attackers use UDP-based DNS queries and responses — lacking handshakes or verification — making it easier to send fake replies before legitimate ones reach the server. Once the cache is poisoned, every client of the compromised resolver receives false information until the cache’s time-to-live expires.
The flaws, assigned CVE-2025-40778 and CVE-2025-40780, impact BIND versions from 9.11.0 through various 9.21.x releases, threatening the integrity of internet traffic by enabling attackers to manipulate DNS caches and redirect users to malicious destinations.
The first bug allows BIND to incorrectly accept unsolicited DNS records that do not match legitimate query criteria, while the second exploits deficiencies in pseudo-random number generation, letting attackers predict crucial attributes like query ID and source port.
These weaknesses echo the infamous “Kaminsky bug” of 2008, which had exposed similarly dangerous flaws in DNS protocol design. Both recent vulnerabilities have a CVSS score of 8.6, highlighting their potential for widespread disruption. A study by Censys has found over 700,000 public-facing BIND resolvers currently at risk, raising the need for immediate mitigation.
Proof-of-concept exploits are now circulating, prompting ISC to urge rapid upgrades to patched BIND versions (9.18.41, 9.20.15, and 9.21.14) and to use best practices such as enabling DNSSEC, restricting recursion, and vigilant monitoring of DNS caches.
While no widespread abuse has been tracked so far, experts emphasize patching as the only reliable protection against fraud, hijacking, and network outages.
