CVE-2025-40777
A possible assertion failure when 'stale-answer-client-timeout' is set to '0'
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A possible assertion failure when 'stale-answer-client-timeout' is set to '0'
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
CVE-2025-40777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
EUVDEUVD-2025-21736
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
EUVD-2025-21736- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4x4c-8qp9-8ggh
If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale...
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
GHSA-4x4c-8qp9-8ggh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
CVE-2025-40777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-40777
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
ALPINE-CVE-2025-40777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2025-40777
- Record
BELL-CVE-2025-40777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSV
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
CVE-2025-40777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-40777
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
DEBIAN-CVE-2025-40777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-40777
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
UBUNTU-CVE-2025-40777- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-65553 No score
CVE-2025-40777 affecting package bind for versions less than 9.20.15-1
If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer-client-timeout set to 0 (the only allowable value other than disabled), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.
- Record
AZL-65553- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15354-1 No score
bind-9.20.11-1.1 on GA media
These are all security issues fixed in the bind-9.20.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15354-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2025-40777 No score
CVE-2025-40777 in bind9 - Patched by Root
Root has patched CVE-2025-40777 in the bind9 package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2025-40777- Updated
- 2026-11-02
OSVSUSE-SU-2025:02349-1 No score
Security update for bind
This update for bind fixes the following issues:
- Upgrade to release 9.20.11
- CVE-2025-40777: Fixed a possible assertion failure when stale-answer-client-timeout is set to 0. (bsc#1246548)
- Record
SUSE-SU-2025:02349-1- Updated
- 2026-11-02
OSVUSN-7641-1 No score
bind9 vulnerability
It was discovered that Bind incorrectly handled configurations where the stale-answer-client-timeout option is set to 0. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.
- Record
USN-7641-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bindAlpine:v3.22 |
before 9.20.11-r0 | 9.20.11-r0 |
bindAlpine:v3.23 |
before 9.20.11-r0 | 9.20.11-r0 |
bindAlpine:v3.24 |
before 9.20.11-r0 | 9.20.11-r0 |
bindAzure Linux:3 |
before 9.20.15-1 | 9.20.15-1 |
bindAlpaquita:25 |
9.20.9-r0 up to 9.20.11-r0 | 9.20.11-r0 |
bindAlpaquita:stream |
9.20.5-r0 up to 9.20.11-r0 | 9.20.11-r0 |
bind9Debian:13 |
before 1:9.20.11-1 | 1:9.20.11-1 |
bind9Debian:14 |
before 1:9.20.11-1 | 1:9.20.11-1 |
bind9Root:Debian:11 |
before 1:9.16.50-1~deb11u6.aikido.8 | 1:9.16.50-1~deb11u6.aikido.8 |
rootio-bind9Root:Debian:11 |
before 1:9.16.50-1~deb11u6.aikido.8 | 1:9.16.50-1~deb11u6.aikido.8 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bindSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 9.20.11-150700.3.6.1 | 9.20.11-150700.3.6.1 |
bindSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 9.20.11-150700.3.6.1 | 9.20.11-150700.3.6.1 |
bind9Ubuntu:25.04 |
before 1:9.20.4-3ubuntu1.2, plus listed versions 1:9.20.0-2ubuntu31:9.20.0-2ubuntu41:9.20.4-3ubuntu11:9.20.4-3ubuntu1.1 |
1:9.20.4-3ubuntu1.2 |
bindopenSUSE:Tumbleweed |
before 9.20.11-1.1 | 9.20.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-40777 is a high vulnerability (CVSS 7.5) in Isc Bind 9, published July 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in bind 9.20.11-r0.