Cache poisoning vulnerabilities found in 2 DNS resolving apps

“In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use,” BIND developers wrote in Wednesday’s disclosure. “BIND can be tricked into caching attacker responses, if the spoofing is successful.”

CVE-2025-40778 also raises the possibility of reviving cache poisoning attacks.

“Under certain circumstances, BIND is too lenient when…