Detections
Analytics

Alpine: multiple bind packages: security update to 9.18.41-r0

high Tenable Cloud Security Plugin ID 435759

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead
 to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13,
 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-8677)

 - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker
 to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0
 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1
 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

 - In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it
 is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects
 BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through
 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.
 (CVE-2025-40780)

See Also

https://security.alpinelinux.org/vuln/CVE-2025-40778

https://security.alpinelinux.org/vuln/CVE-2025-40780

https://security.alpinelinux.org/vuln/CVE-2025-8677

Plugin Details

Severity: High

ID: 435759

Version: Revision 1.9

Type: Local

Published: 10/23/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.1

Percentile: 96.85

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2025-40780

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/22/2025

Reference Information

CVE: CVE-2025-40778, CVE-2025-40780, CVE-2025-8677

IAVA: 2025-A-0800