CVE-2025-40775
When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.
- Score
- CVSS 3.1 7.5 High
- Status
- Deferred - security-officer@isc.org
- Published
- 2025-05-21
- Last modified
- 2025-05-23
- Weaknesses
- CWE-232
Affected products
References
- https://kb.isc.org/docs/cve-2025-40775
- http://www.openwall.com/lists/oss-security/2025/05/21/1
- https://security.netapp.com/advisory/ntap-20250523-0001/
