{"id":"CVE-2025-40776","aliases":["ALPINE-CVE-2025-40776","BELL-CVE-2025-40776","EUVD-2025-21705","GHSA-2hm8-9847-q7gc"],"status":"published","title":"Birthday Attack against Resolvers supporting ECS","description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00227,"percentile":0.13475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-349"],"published":"2025-07-16T13:41:01Z","modified":"2026-08-27T22:18:02Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.20.9-r0"},{"fixed":"9.20.11-r0"}]}]}],"products":[{"vendor":"isc","product":"bind 9"}],"references":[{"url":"https://kb.isc.org/docs/cve-2025-40776","tags":["vendor-advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40776"},{"url":"https://github.com/advisories/GHSA-2hm8-9847-q7gc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-40776","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-40776","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-40776","title":"Birthday Attack against Resolvers supporting ECS","description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T13:41:01.337Z","modified":"2025-07-22T14:55:04.42Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-21705","description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T13:41:01Z","modified":"2025-07-22T14:55:04Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:05.744165Z"}],"ghsa":[{"id":"GHSA-2hm8-9847-q7gc","title":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be...","description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T15:32:32Z","modified":"2025-07-16T15:32:33Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T15:03:02.246159Z"}],"nvd":[{"id":"CVE-2025-40776","description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T14:15:25.053Z","modified":"2026-06-17T09:22:07.257Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"ALPINE-CVE-2025-40776","description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T14:15:25.053Z","modified":"2026-08-27T22:18:02.894053247Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-40776","status":"published","published":"2025-07-17T18:18:50.363619Z","modified":"2026-01-26T09:40:26.514118Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-40776","description":"A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.\nThis issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T14:15:25Z","modified":"2026-04-10T05:26:25.954394Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:49.394967Z"}]}}