CVE-2025-40777

Name of the Vulnerable Software and Affected Versions BIND versions 9.20.0 through 9.20.10 BIND versions 9.21.0 through 9.21.9 BIND versions 9.20.9-S1 through 9.20.10-S1

Description If a named caching resolver is configured with serve-stale-enable set to yes, and with stale-answer-client-timeout set to 0, and if the resolver encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.

Recommendations Update BIND to a version beyond 9.20.10, 9.21.9, and 9.20.10-S1.