Back Linuxsecurity

Fedora 43: bind9-next Security Update CVE-2025

Linuxsecurity •LinuxSecurity Advisories • November 16, 2025

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Update Information : Update to 9.21.14 (rhbz#2394406) Security Fixes: DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677) Address various spoofing attacks. (CVE-2025-40778) Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780) New Features: Add dnssec-policy keys configuration check to named-checkconf. Add support for synthetic records. Support for zone-specific plugins. Support for additional tokens in the zone file name template. Removed Features: Remove randomized RRset ordering. and bug fixes bind-9-21-14

BIND (Berkeley Internet Name Domain) is an implementation of the DNS

(Domain Name System) protocols. BIND includes a DNS server (named),

which resolves host names to IP addresses; a resolver library

(routines for applications to use when interfacing with DNS); and

tools for verifying that the DNS server is operating properly.

Update to 9.21.14 (rhbz#2394406) Security Fixes: DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677) Address various spoofing attacks. (CVE-2025-40778) Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780) New Features: Add dnssec-policy keys configuration check to named-checkconf. Add support for synthetic records. Support for zone-specific plugins. Support for additional tokens in the zone file name template. Removed Features: Remove randomized RRset ordering. and bug fixes bind-9-21-14

* Thu Nov 6 2025 Petr Men\u0161k - 32:9.21.14-2 - Prevent SERVFAIL on dual signed zones with one unsupported signature (rhbz#2413104) * Thu Nov 6 2025 Petr Men\u0161k - 32:9.21.14-1 - Update to 9.21.14 (rhbz#2394406) * Tue Oct 7 2025 Petr Men\u0161k - 32:9.21.12-4 - Update a bit sample named.conf * Thu Sep 11 2025 Petr Men\u0161k - 32:9.21.12-3 - Meson libs include version in upstream already * Wed Sep 10 2025 Petr Men\u0161k - 32:9.21.12-1 - Update to 9.21.12 (rhbz#2394406) * Wed Sep 10 2025 Petr Men\u0161k - 32:9.21.11-6 - Return back fortify=3 source * Tue Sep 9 2025 Petr Men\u0161k - 32:9.21.11-5 - Remove separate license subpackage

[ 1 ] Bug #2394406 - bind9- -9.21.14 is available [ 2 ] Bug #2396295 - named-chroot fails to start: isc_dir_chroot: not implemented [ 3 ] Bug #2406399 - CVE-2025-40778 [Severity: High] bind9: Cache poisoning attacks with unsolicited RRs [ 4 ] Bug #2413104 - Regression with disabled algorithms after CVE-2025-8677 fixes

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-b68f7f541d' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43 and 42 Address Critical DNSSEC Vulnerability in BIND Fedora has released security updates for BIND, addressing a critical DNSSEC validation issue. The vulnerability, identified as CVE-2025-8677, allows DNSSEC validation to fail if a matching but invalid DNSKEY is found, potentially leading to spoofing attacks. The updates apply to BIND version 9.21.14. 2 sources 18

Extracted Entities

CVEs (3)

CVE-2025-40778 CVE-2025-40780 CVE-2025-8677

Vulnerabilities (1)

DNS Cache Poisoning