VDB
ALPINE-CVE-2025-40778
ALPINE-CVE-2025-40778
PUBLISHED
CVSS 8.600000381469727 HIGH
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.24 | bind | 0, 0 |
| Alpine:v3.19 | bind | 9.8.0_p2-r1, *, 9.18.3-r1 |
| Alpine:v3.22 | bind | 9.11.0_p2-r1, 9.10.4_p4-r0, 9.10.4_p3-r1 |
| Alpine:v3.20 | bind | 9.10.4_p3-r1, 0, 9.10.0-r0 |
| Alpine:v3.23 | bind | 9.6.0, 9.6.1, 9.6.1 |
| Alpine:v3.21 | bind | 9.6.0, 9.18.9-r0, 9.18.8-r0 |
Timeline
- Oct 22, 2025 CVE Published
- Jun 15, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch