CVE-2025-13878 Malformed BRID/HHIT records can cause named to terminate unexpectedly
Attackers can cause the BIND DNS server to crash by sending malformed BRID or HHIT records, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13878?
CVE-2025-13878 is a high-severity denial of service vulnerability in ISC BIND 9, published on 21 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.
Which versions are affected by CVE-2025-13878?
Linux distribution packages (6)
bind SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 9.20.18-150700.3.15.1 |
bind SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 9.20.18-150700.3.15.1 |
bind SUSE:Linux Enterprise Server 16.0 | All versions | 9.20.18-160000.1.1 |
bind SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 9.20.18-160000.1.1 |
bind openSUSE:Leap 16.0 | All versions | 9.20.18-160000.1.1 |
bind openSUSE:Tumbleweed | All versions | 9.20.18-1.1 |
How do I fix CVE-2025-13878?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-13878 being exploited?
There is no known exploitation of CVE-2025-13878 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-13878, AZL-75074, BELL-CVE-2025-13878, DEBIAN-CVE-2025-13878, DSA-6107-1, GHSA-p5qx-fwf5-q388 and 5 more.