CVE-2025-40780 Cache poisoning due to weak PRNG
Attackers can predict DNS query parameters due to weak PRNG, enabling cache poisoning attacks against BIND servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40780?
CVE-2025-40780 is a high-severity vulnerability in ISC BIND 9, published on 22 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Weakness: CWE-341
Which versions are affected by CVE-2025-40780?
How do I fix CVE-2025-40780?
Upgrade to a fixed version.
Is CVE-2025-40780 being exploited?
There is no known exploitation of CVE-2025-40780 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-40780, AZL-68730, AZL-68739, BELL-CVE-2025-40780, DEBIAN-CVE-2025-40780, GHSA-j3w4-m6qj-vmm5 and 2 more.