CVE-2025-40775

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

These are all security issues fixed in the bind-9.20.9-1.1 package on the GA media of openSUSE Tumbleweed.

This update for bind fixes the following issues:

Update to version 9.20.9.

• Security issues fixed:

  • CVE-2025-40775: denial-of-service due to assertion failure caused by the processing of a NS message with an invalid TSIG (bsc#1243361).
  • CVE-2024-12705: CPU and memory exhaustion due to DNS-over-HTTPS issues that arise under heavy query load (bsc#1236597).
  • CVE-2024-11187: CPU exhaustion when processing queries that lead to responses containing several records in the Additional data section (bsc#1236596).

• Changelog:

  • Feature changes:

    • Performance optimization for NSEC3 lookups introduced in BIND 9.20.2 was reverted to avoid risks associated with a complex code change.
    • The configuration clauses parental-agents and primaries are renamed to remote-servers.
    • Add none parameter to query-source and query-source-v6 to disable IPv4 or IPv6 upstream queries but allow listening to queries from clients on IPv4 or IPv6.
    • dnssec-ksr now supports KSK rollovers.
    • Print RFC 7314: EXPIRE option in transfer summary.
    • Emit more helpful log messages for exceeding max-records-per-type.
    • Harden key management when key files have become unavailable.

  • New Features:

    • Add support for EDE 20 (Not Authoritative).
    • Add support for EDE 7 and EDE 8.
    • dig can now display the received BADVERS message during negotiation.
    • Add an rndc command to reset some statistics counters.
    • Implement the min-transfer-rate-in configuration option.
    • Add HTTPS record query to host command line tool.
    • Implement sig0key-checks-limit and sig0message-checks-limit.
    • Adds support for EDE code 1 and 2.
    • Add an rndc command to toggle jemalloc profiling.
    • Add support for multiple extended DNS errors.
    • Print the expiration time of stale records.
    • Add Extended DNS Error Code 22 - No Reachable Authority.
    • Add a new option to configure the maximum number of outgoing queries per client request.
    • Use the Server Name Indication (SNI) extension for all outgoing TLS connections.
    • Update built-in bind.keys file with the new 2025 IANA root key.
    • Add an initial-ds entry to bind.keys for the new root key, ID 38696, which is scheduled for publication in January 2025.

  • Bug Fixes:

    • Restore NSEC3 closest-encloser lookup improvements.
    • Stop caching lack of EDNS support.
    • Fix resolver statistics counters for timed-out responses.
    • Nested DNS validation could cause an assertion failure.
    • Wait for memory reclamation to finish in named-checkconf.
    • Ensure max-clients-per-query is at least clients-per-query.
    • Fix write after free in validator code.
    • Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
    • Fix several small DNSSEC timing issues.
    • Fix inconsistency in CNAME/DNAME handling during resolution.
    • Fix dual-stack-servers configuration option.
    • Fix a data race causing a permanent active client increase.
    • Fix deferred validation of unsigned DS and DNSKEY records.
    • Fix RPZ race condition during a reconfiguration.
    • 'CNAME and other data check' not applied to all types.
    • Relax private DNSKEY and RRSIG constraints.
    • Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    • Fix TTL issue with ANY queries processed through RPZ 'passthru';.
    • dnssec-signzone needs to check for a NULL key when setting offline.
    • Fix a bug in the statistics channel when querying zone transfer information.
    • Fix assertion failure when dumping recursing clients.
    • Dump the active resolver fetches from dns_resolver_dumpfetches().
    • Recently expired records could be returned with a timestamp in future.
    • YAML string not terminated in negative response in delv.
    • Fix a bug in dnssec-signzone related to keys being offline.
    • Apply the memory limit only to ADB database items.
    • Avoid unnecessary…

It was discovered that Bind incorrectly handled certain DNS messages with invalid TSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.