CVE-2025-40775 — DNS message with invalid TSIG causes an assertion failure

CVE-2025-40775

DNS message with invalid TSIG causes an assertion failure PUBLISHED

Description (CNA)

When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.

Affected (CNA)

Vendor / product	Versions
ISC / BIND 9	affected 9.20.0 through 9.20.8; affected 9.21.0 through 9.21.7

CWE

CWE-232

References

https://kb.isc.org/docs/cve-2025-40775

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/05/21/1
https://security.netapp.com/advisory/ntap-20250523-0001/