CVE-2025-40776: BIND 9 Cache Poisoning Vulnerability

CVE-2025-40776 Overview

CVE-2025-40776 is a cache-poisoning vulnerability in ISC BIND 9 named caching resolvers configured to send EDNS Client Subnet (ECS) options. An attacker can inject forged DNS records into the resolver cache, redirecting clients to attacker-controlled destinations. The flaw is categorized under [CWE-349] Acceptance of Extraneous Untrusted Data With Trusted Data. It affects BIND 9 Supported Preview Edition (-S1) releases used by ISC support subscribers. The issue is network-reachable, requires no authentication, and impacts integrity of resolver responses across all downstream clients.

Critical Impact
Successful exploitation poisons the resolver cache, allowing attackers to redirect DNS lookups for any domain served through the affected resolver to malicious infrastructure.

Affected Products

ISC BIND 9 versions 9.11.3-S1 through 9.16.50-S1
ISC BIND 9 versions 9.18.11-S1 through 9.18.37-S1
ISC BIND 9 versions 9.20.9-S1 through 9.20.10-S1

Discovery Timeline

2025-07-16 - CVE-2025-40776 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-40776

Vulnerability Analysis

The vulnerability resides in the ECS (EDNS Client Subnet) handling logic of named when configured as a caching resolver. ECS is an EDNS0 extension that forwards a portion of the client's IP prefix to authoritative servers so they can return geographically tailored answers. When named sends ECS options upstream, it must correctly associate cached responses with the specific client subnet scope returned by the authoritative server. The flawed handling allows attacker-supplied response data to be accepted and stored alongside trusted cache entries, satisfying the [CWE-349] pattern of mixing trusted and untrusted data.

Root Cause

The root cause is improper validation of ECS-scoped responses before cache insertion. The resolver fails to enforce strict binding between the queried name, the ECS scope, and the source authority of the response. An off-path or on-path attacker who can predict or race resolver queries can inject crafted responses that pass acceptance checks. Once cached, those records are served to any client whose query matches the poisoned scope.

Attack Vector

Exploitation requires the resolver to have ECS forwarding enabled, which is not the default configuration. An attacker triggers a recursive lookup against the victim resolver, then floods spoofed responses carrying ECS options that match expected scope parameters. If accepted, the forged record replaces or coexists with legitimate cache data. Because the attack targets shared cache state, a single successful poisoning event affects every downstream client of the resolver. The vulnerability does not directly impact confidentiality or availability, but redirected DNS responses enable phishing, credential theft, and supply-chain interception. See the ISC CVE-2025-40776 Advisory for protocol-level technical detail.

Detection Methods for CVE-2025-40776

Indicators of Compromise

Unexpected DNS responses for high-value domains containing ECS scope values that do not match client subnets.
Cache entries in named whose authority section references unfamiliar nameservers.
Spikes in inbound UDP/53 traffic with malformed or duplicate EDNS Client Subnet options.
Client reports of TLS certificate mismatches when reaching well-known services through the affected resolver.

Detection Strategies

Audit named.conf for send-cookies, ecs-zones, or any directive enabling outbound ECS forwarding.
Compare resolver answers against an authoritative out-of-band lookup using dig +subnet and validate consistency.
Enable BIND query logging (querylog yes;) and analyze response anomalies and TTL irregularities.
Correlate DNS telemetry with endpoint and proxy logs to identify clients reaching unexpected IP destinations.

Monitoring Recommendations

Forward named logs and passive DNS data to a centralized SIEM for longitudinal cache analysis.
Alert on cache entries whose answer records change rapidly or diverge from authoritative ground truth.
Monitor for spoofed source addresses targeting resolver listener IPs and rate-limit suspicious flows.

How to Mitigate CVE-2025-40776

Immediate Actions Required

Identify all BIND 9 Supported Preview Edition (-S1) deployments and inventory their version strings.
Upgrade affected resolvers to a fixed -S1 release listed in the ISC advisory.
If patching is not immediately possible, disable ECS forwarding on caching resolvers.
Flush resolver caches after patching to remove any pre-existing poisoned entries.

Patch Information

ISC has published fixed BIND 9 Supported Preview Edition builds. Refer to the ISC CVE-2025-40776 Advisory for the exact upgrade targets corresponding to each affected branch (9.16-S1, 9.18-S1, 9.20-S1).

Workarounds

Disable outbound ECS by removing or commenting ecs-zones and related ECS forwarding directives in named.conf.
Restrict recursion to trusted client networks using allow-recursion access control lists.
Enforce DNSSEC validation on the resolver to detect tampered responses for signed zones.
Deploy response rate limiting and source-address validation upstream to reduce spoofed traffic.

bash

# Configuration example: disable ECS forwarding in named.conf
options {
    // Remove or comment any ecs-zones directives
    // ecs-zones { example.com; };

    allow-recursion { 10.0.0.0/8; 192.168.0.0/16; };
    dnssec-validation auto;
    querylog yes;
};