p PatchFirst

CVE-2025-13878

CVE-2025-13878 · Malformed BRID/HHIT records can cause named to terminate unexpectedly

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

CVSS 7.5 · High · EPSS 9.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • bind 9

    Versions
    • ≥ 9.18.40, ≤ 9.18.43: Affected (custom)
    • ≥ 9.20.13, ≤ 9.20.17: Affected (custom)
    • ≥ 9.21.12, ≤ 9.21.16: Affected (custom)
    • ≥ 9.18.40-S1, ≤ 9.18.43-S1: Affected (custom)
    • ≥ 9.20.13-S1, ≤ 9.20.17-S1: Affected (custom)

    No fix published

  • bind9 Debian:12

    Versions
    • 1:9.18.12-1
    • 1:9.18.13-1
    • 1:9.18.16-1
    • 1:9.18.16-1~deb12u1
    • 1:9.18.16-1~deb12u1~bpo11+1
    • 1:9.18.19-1~deb12u1
    • 1:9.18.19-1~deb12u1~bpo11+1
    • 1:9.18.24-1
    • 1:9.18.24-1~bpo11+1
    • 1:9.18.28-1~deb12u1
    • 1:9.18.28-1~deb12u2
    • 1:9.18.33-1~deb12u2
    • 1:9.18.41-1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 1:9.18.44-1~deb12u1

    Update to 1:9.18.44-1~deb12u1

  • bind9 Debian:13

    Versions
    • 1:9.20.11-4
    • 1:9.20.15-1
    • 1:9.20.15-1~deb13u1
    • 1:9.20.15-1~deb13u1~bpo12+1
    • 1:9.20.15-2
    • 1:9.20.18-1~deb13u1~bpo12+1
    Affected ranges
    • ECOSYSTEM: < 1:9.20.18-1~deb13u1

    Update to 1:9.20.18-1~deb13u1

  • bind9 Debian:14

    Versions
    • 1:9.20.11-4
    • 1:9.20.15-1
    • 1:9.20.15-1~deb13u1
    • 1:9.20.15-1~deb13u1~bpo12+1
    • 1:9.20.15-2
    • 1:9.20.18-1~deb13u1
    • 1:9.20.18-1~deb13u1~bpo12+1
    Affected ranges
    • ECOSYSTEM: < 1:9.20.18-1

    Update to 1:9.20.18-1

Original sources

Check your server →