CVE-2025-8677

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.isc.org/docs/cve-2025-8677
http://www.openwall.com/lists/oss-security/2025/10/22/1

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Consultar registros dentro de una zona especialmente diseñada que contiene ciertos registros DNSKEY malformados puede llevar al agotamiento de la CPU. Este problema afecta a las versiones de BIND 9 9.18.0 hasta 9.18.39, 9.20.0 hasta 9.20.13, 9.21.0 hasta 9.21.12, 9.18.11-S1 hasta 9.18.39-S1, y 9.20.9-S1 hasta 9.20.13-S1.

Information

Published : 2025-10-22 16:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-8677

Mitre link : CVE-2025-8677

CVE.ORG link : CVE-2025-8677

JSON object : View

Products Affected

No product.

CWE

CWE-405

Asymmetric Resource Consumption (Amplification)

{"id": "CVE-2025-8677", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8677", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T17:29:14.290863Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "BIND 9", "versions": [{"status": "affected", "version": "9.18.0", "versionType": "custom", "lessThanOrEqual": "9.18.39"}, {"status": "affected", "version": "9.20.0", "versionType": "custom", "lessThanOrEqual": "9.20.13"}, {"status": "affected", "version": "9.21.0", "versionType": "custom", "lessThanOrEqual": "9.21.12"}, {"status": "affected", "version": "9.18.11-S1", "versionType": "custom", "lessThanOrEqual": "9.18.39-S1"}, {"status": "affected", "version": "9.20.9-S1", "versionType": "custom", "lessThanOrEqual": "9.20.13-S1"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-22T16:15:46.043", "references": [{"url": "https://kb.isc.org/docs/cve-2025-8677", "source": "security-officer@isc.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/22/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-405"}]}], "descriptions": [{"lang": "en", "value": "Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1."}, {"lang": "es", "value": "Consultar registros dentro de una zona especialmente dise\u00f1ada que contiene ciertos registros DNSKEY malformados puede llevar al agotamiento de la CPU.\nEste problema afecta a las versiones de BIND 9 9.18.0 hasta 9.18.39, 9.20.0 hasta 9.20.13, 9.21.0 hasta 9.21.12, 9.18.11-S1 hasta 9.18.39-S1, y 9.20.9-S1 hasta 9.20.13-S1."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "security-officer@isc.org"}