CVE-2025-40775

An assertion failure vulnerability was found in the BIND package. When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. By sending specific messages to the server, an attacker can cause named to terminate unexpectedly, causing a denial of service.

No Red Hat products or offerings are affected by this vulnerability as the affected code is not used in Red Hat systems.

Although Red Hat does not ship this vulnerable code, we rated the impact of this vulnerability for the upstream community users marked as Important rather than a Moderate flaw because it triggers an assertion failure within BIND's core DNS handling logic, specifically in the TSIG validation path. Unlike typical input validation errors, which might allow an attacker to manipulate a single query's processing, this bug results in a complete and immediate crash of the named daemon. Since both authoritative servers and resolvers perform TSIG verification, the vulnerability can be exploited remotely by an unauthenticated attacker to cause repeated service outages, effectively disrupting DNS resolution for entire domains or networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.