ISC BIND DoS Vulnerability (CVE-2025-8677) - Windows

ISC BIND is prone to a denial of service DoS vulnerability via malformed DNSKEY handling. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Bind vulnerabilities (USN-7836-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7836-1 advisory. Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could...

USN-7836-1: Bind vulnerabilities

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. CVE-2025-8677 Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that...

USN-7836-1 bind9 vulnerabilities

Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to consume resources, resulting in a denial of service. CVE-2025-8677 Yuxiao Wu, Yunyi Zhang, Baojun Liu, and Haixin Duan discovered that...

CVE-2025-8677

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1...

ALPINE-CVE-2025-8677

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1...

CVE-2025-8677

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1...

CVE-2025-8677

CVE-2025-8677 affects ISC BIND 9 where querying specially crafted zones with malformed DNSKEY records can exhaust CPU. Affected ranges include 9.18.x (up to 9.18.39, plus S1 builds) and 9.20.x (up to 9.20.13, plus S1 builds), and 9.21.x up to 9.21.12. Connected advisories confirm a fix is availab...

PT-2025-43379

Name of the Vulnerable Software and Affected Versions BIND versions 9.18.0 through 9.18.39 BIND versions 9.20.0 through 9.20.13 BIND versions 9.21.0 through 9.21.12 BIND versions 9.18.11-S1 through 9.18.39-S1 BIND versions 9.20.9-S1 through 9.20.13-S1 Description Querying for records within a...

UBUNTU-CVE-2025-8677

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1...

EUVD-2025-4078

Malicious code in bioql PyPI...

[SECURITY] [DLA 4226-1] dns-root-data DNSSEC trust anchors update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4226-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler June 23, 2025 https://wiki.debian.org/LTS -...

Debian dla-4226 : dns-root-data - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4226 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4226-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2010-3614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security...

The vulnerability of the verify_dnskey_rrset() function in the Hickory DNS client (formerly Trust-DNS) allows a attacker to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the verifydnskeyrrset function in the Hickory DNS client formerly Trust-DNS is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected informati...

CVE-2025-25188

Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validati...

GHSA-V7PC-74H8-XQ2H Hickory DNS failure to verify self-signed RRSIG for DNSKEYs

Summary The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to...

Hickory DNS failure to verify self-signed RRSIG for DNSKEYs

Summary The DNSSEC validation routines treat entire RRsets of DNSKEY records as trusted once they have established trust in only one of the DNSKEYs. As a result, if a zone includes a DNSKEY with a public key that matches a configured trust anchor, all keys in that zone will be trusted to...

DEBIAN-CVE-2025-25188

Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validati...

CVE-2025-25188

Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validati...