{"id":86408,"date":"2026-02-07T19:03:35","date_gmt":"2026-02-07T19:03:35","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-40775-bind-dns-server-vulnerability-due-to-invalid-tsig-algorithm-field","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-40775-bind-dns-server-vulnerability-due-to-invalid-tsig-algorithm-field\/","title":{"rendered":"CVE-2025-40775: BIND DNS Server Vulnerability due to Invalid TSIG algorithm Field<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report discusses the vulnerability CVE-2025-40775, which affects BIND DNS server versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7. This vulnerability is significant as it potentially allows unauthorized access to systems, leading to data leakage or system compromise. Given the widespread use of BIND DNS servers, this vulnerability poses a considerable risk to secure information exchange and integrity of systems across the globe.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-40775
\nSeverity: High (7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential for system compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

BIND DNS Server | 9.20.0 – 9.20.8
\nBIND DNS Server | 9.21.0 – 9.21.7<\/p>\n

How the Exploit Works<\/strong><\/p>\n

When the BIND DNS server receives an incoming DNS protocol message that includes a Transaction Signature (TSIG), it always checks this signature. If the TSIG contains an invalid value in its algorithm field, the BIND server is forced to abort its operation with an assertion failure. This behavior can be exploited by attackers to interrupt the DNS service, leading to potential system compromise or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of how a DNS protocol message with an invalid TSIG might be sent to exploit this vulnerability:<\/p>\n

POST \/dns-query HTTP\/1.1\nHost: vulnerable-dns-server.com\nContent-Type: application\/dns-message\n{\n\"header\": {\n\"id\": \"1234\",\n\"opcode\": \"QUERY\",\n\"rcode\": \"NOERROR\",\n\"flags\": [\"qr\",\"rd\",\"ra\"],\n\"qdcount\": \"1\",\n\"ancount\": \"0\",\n\"nscount\": \"0\",\n\"arcount\": \"1\"\n},\n\"question\": [{\"name\": \"example.com.\", \"type\": \"A\"}],\n\"additional\": [\n{\n\"name\": \"transaction-key.\",\n\"type\": \"TSIG\",\n\"algorithm\": \"invalid-algorithm\",\n\"time_signed\": \"20250314120000\",\n\"fudge\": \"300\",\n\"error\": \"NOERROR\",\n\"other_data\": \"\"\n}\n]\n}<\/code><\/pre>\n
In this example, the “algorithm” field of the TSIG contains an invalid value (“invalid-algorithm”), which would cause the BIND server to abort its operation with an assertion failure.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report discusses the vulnerability CVE-2025-40775, which affects BIND DNS server versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7. This vulnerability is significant as it potentially allows unauthorized access to systems, leading to data leakage or system compromise. Given the widespread use of BIND DNS servers, this vulnerability poses a considerable risk to secure […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86408","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t