CVE-2025-40777

An assertion failure flaw has been discovered in bind. If a named caching resolver is configured with serve-stale-enable: yes, and with stale-answer-client-timeout set to 0, and if the resolver, in the process of resolving a query, encounters a CNAME chain involving a specific combination of cached or authoritative records, the daemon will abort with an assertion failure.

On Red Hat systems, the host operating system will not be taken down with the bind daemon. A crashed daemon is likely to be restarted by the host mitigating the availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.