ISC BIND up to 9.21.12 Zone amplification

Summaryinfo

A vulnerability, which was classified as problematic, was found in ISC BIND up to 9.18.39/9.18.39-S1/9.20.13/9.20.13-S1/9.21.12. This affects an unknown part of the component Zone Handler. Such manipulation leads to amplification. This vulnerability is listed as CVE-2025-8677. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in ISC BIND up to 9.18.39/9.18.39-S1/9.20.13/9.20.13-S1/9.21.12. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Zone Handler. The manipulation with an unknown input leads to a amplification vulnerability. Using CWE to declare the problem leads to CWE-405. The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric." Impacted is availability. CVE summarizes:

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

The advisory is shared for download at kb.isc.org. This vulnerability is handled as CVE-2025-8677 since 08/06/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 271258 (Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : Bind vulnerabilities (USN-7836-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (271258) and CERT Bund (WID-SEC-2025-2392). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• RESF Rocky Linux
• F5 BIG-IP
• Internet Systems Consortium BIND
• Dell NetWorker

Productinfo

Type

• Domain Name Software

Vendor

• ISC

Name

• BIND

Version

• 9.18.0
• 9.18.1
• 9.18.2
• 9.18.3
• 9.18.4
• 9.18.5
• 9.18.6
• 9.18.7
• 9.18.8
• 9.18.9
• 9.18.10
• 9.18.11
• 9.18.12
• 9.18.13
• 9.18.14
• 9.18.15
• 9.18.16
• 9.18.17
• 9.18.18
• 9.18.19
• 9.18.20
• 9.18.21
• 9.18.22
• 9.18.23
• 9.18.24
• 9.18.25
• 9.18.26
• 9.18.27
• 9.18.28
• 9.18.29
• 9.18.30
• 9.18.31
• 9.18.32
• 9.18.33
• 9.18.34
• 9.18.35
• 9.18.36
• 9.18.37
• 9.18.38
• 9.18.39
• 9.18.39-S1
• 9.20.0
• 9.20.1
• 9.20.2
• 9.20.3
• 9.20.4
• 9.20.5
• 9.20.6
• 9.20.7
• 9.20.8
• 9.20.9
• 9.20.10
• 9.20.11
• 9.20.12
• 9.20.13
• 9.20.13-S1
• 9.21.0
• 9.21.1
• 9.21.2
• 9.21.3
• 9.21.4
• 9.21.5
• 9.21.6
• 9.21.7
• 9.21.8
• 9.21.9
• 9.21.10
• 9.21.11
• 9.21.12

License

• open-source

Website

• Vendor: https://www.isc.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion