CVE-2025-40776CWE-349

Birthday Attack against Resolvers supporting ECS

High · published July 16, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

A `named` caching resolver that is configured to send ECS (EDNS Client Subnet) options may be vulnerable to a cache-poisoning attack.

This issue affects BIND 9 versions 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.37-S1, and 9.20.9-S1 through 9.20.10-S1.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.9th percentile
Weakness
CWE-349 · Acceptance of Extraneous Untrusted Data With Trusted Data
Published
2025-07-16T13:41Z
EPSS history
Timeline
  • 16 JUL 13:41Z
    Birthday Attack against Resolvers supporting ECS
    cvelistv5