{"id":"CVE-2025-40777","aliases":["ALPINE-CVE-2025-40777","AZL-65553","BELL-CVE-2025-40777","DEBIAN-CVE-2025-40777","EUVD-2025-21736","GHSA-4x4c-8qp9-8ggh","ROOT-OS-DEBIAN-11-CVE-2025-40777","SUSE-SU-2025:02349-1","UBUNTU-CVE-2025-40777","USN-7641-1","openSUSE-SU-2025:15354-1"],"status":"published","title":"A possible assertion failure when 'stale-answer-client-timeout' is set to '0'","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01025,"percentile":0.64028,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2025-07-16T00:00:00Z","modified":"2026-10-23T13:00:06Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"bind","fixed_in":["9.20.15-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"bind","fixed_in":["9.20.11-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bind9","fixed_in":["1:9.20.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bind9","fixed_in":["1:9.20.11-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"bind9","fixed_in":["1:9.16.50-1~deb11u6.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-bind9","fixed_in":["1:9.16.50-1~deb11u6.aikido.8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"bind","fixed_in":["9.20.11-150700.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"bind","fixed_in":["9.20.11-150700.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.04","package":"bind9","fixed_in":["1:9.20.4-3ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bind","fixed_in":["9.20.11-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.15-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.20.9-r0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.20.5-r0"},{"fixed":"9.20.11-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.11-1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.16.50-1~deb11u6.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.16.50-1~deb11u6.aikido.8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-150700.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-150700.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.04","package":"bind9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.20.4-3ubuntu1.2"}]}],"versions":["1:9.20.0-2ubuntu3","1:9.20.0-2ubuntu4","1:9.20.4-3ubuntu1","1:9.20.4-3ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.11-1.1"}]}]}],"products":[{"vendor":"isc","product":"bind 9"}],"references":[{"url":"https://kb.isc.org/docs/cve-2025-40777","tags":["vendor-advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/16/6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40777","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4x4c-8qp9-8ggh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-40777","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-40777","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-40777","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502349-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40777","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-40777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40777","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7641-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-40777","title":"A possible assertion failure when 'stale-answer-client-timeout' is set to '0'","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T17:38:06.37Z","modified":"2025-11-04T21:10:12.751Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-21736","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T17:38:06Z","modified":"2025-11-04T21:10:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:21.645169Z"}],"ghsa":[{"id":"GHSA-4x4c-8qp9-8ggh","title":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale...","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T18:32:38Z","modified":"2025-11-05T00:31:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:04:38.82847Z"}],"nvd":[{"id":"CVE-2025-40777","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T18:15:24.77Z","modified":"2026-06-17T09:22:07.353Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"ALPINE-CVE-2025-40777","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T18:15:24.77Z","modified":"2026-08-27T22:18:02.896034221Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-40777","status":"published","published":"2025-07-17T06:02:21.439721Z","modified":"2026-01-26T09:40:26.81377Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-40777","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T18:15:24Z","modified":"2026-04-10T05:26:25.711189Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DEBIAN-CVE-2025-40777","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T18:15:24.77Z","modified":"2026-10-23T13:00:06.546150508Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:46.998514Z"},{"id":"UBUNTU-CVE-2025-40777","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"withdrawn","published":"2025-07-16T00:00:00Z","modified":"2026-02-04T04:21:00.727545Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:46.53147Z"},{"id":"AZL-65553","title":"CVE-2025-40777 affecting package bind for versions less than 9.20.15-1","description":"If a `named` caching resolver is configured with `serve-stale-enable` `yes`, and with `stale-answer-client-timeout` set to `0` (the only allowable value other than `disabled`), and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.10, 9.21.0 through 9.21.9, and 9.20.9-S1 through 9.20.10-S1.","status":"published","published":"2025-07-16T18:15:24Z","modified":"2026-04-21T04:48:19.196896Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"openSUSE-SU-2025:15354-1","title":"bind-9.20.11-1.1 on GA media","description":"These are all security issues fixed in the bind-9.20.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-18T00:00:00Z","modified":"2026-03-23T04:53:40.796879Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2025-40777","title":"CVE-2025-40777 in bind9 - Patched by Root","description":"Root has patched CVE-2025-40777 in the bind9 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T14:11:07Z","modified":"2026-08-20T15:15:03.910247399Z","updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"SUSE-SU-2025:02349-1","title":"Security update for bind","description":"This update for bind fixes the following issues:\n\n- Upgrade to release 9.20.11\n- CVE-2025-40777: Fixed a possible assertion failure when stale-answer-client-timeout is set to 0. (bsc#1246548)\n","status":"published","published":"2025-07-17T11:47:22Z","modified":"2026-03-23T04:49:38.193466Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"USN-7641-1","title":"bind9 vulnerability","description":"It was discovered that Bind incorrectly handled configurations where the\nstale-answer-client-timeout option is set to 0. A remote attacker could\npossibly use this issue to cause Bind to crash, resulting in a denial of\nservice.","status":"published","published":"2025-07-16T17:42:21.769692Z","modified":"2025-10-13T04:42:07Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}