CVE-2025-13878

Deferred Deferred - Pending Action

Malformed BRID/HHIT Records Cause BIND Named Crash (DoS

Publication date: 2026-01-21

Last updated on: 2026-06-30

Assigner: Internet Systems Consortium (ISC)

Description

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-21

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-01-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13878

EUVD

EUVD-2026-3599

Affected Vendors & Products

Vendor	Product	Version / Range
isc	bind	From 9.18.40 (inc) to 9.18.43 (inc)
isc	bind	From 9.20.13 (inc) to 9.20.17 (inc)
isc	bind	From 9.21.12 (inc) to 9.21.16 (inc)
isc	bind	From 9.18.40-S1 (inc) to 9.18.43-S1 (inc)
isc	bind	From 9.20.13-S1 (inc) to 9.20.17-S1 (inc)
isc	bind	9.18.44
isc	bind	9.20.18
isc	bind	9.21.17
isc	bind	9.18.44-S1
isc	bind	9.20.18-S1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1286	The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

CVE-2025-13878 is a vulnerability in BIND 9 DNS software where malformed BRID/HHIT DNS records cause the named daemon to terminate unexpectedly. This leads to a denial of service by crashing the DNS server or resolver. The issue affects multiple versions of BIND 9 and can be exploited remotely without authentication or user interaction. [4]

Impact Analysis

This vulnerability can cause your DNS server or resolver running affected BIND 9 versions to crash unexpectedly, resulting in denial of service. This impacts the availability of DNS services, potentially disrupting network operations and access to resources dependent on DNS resolution. [4]

Mitigation Strategies

To mitigate this vulnerability, you should upgrade BIND 9 to one of the patched releases: 9.18.44, 9.20.18, 9.21.17, or the corresponding Supported Preview Editions 9.18.44-S1 and 9.20.18-S1. No workarounds are currently known, so upgrading to a fixed version is the recommended immediate step. [4, 3, 2, 1]

Hi! I’m here to help you understand CVE-2025-13878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70