CVE-2025-13878

HIGH7.5EPSS 0.05%

bind9 - security update

Published: 1/21/2026Modified: 1/22/2026

Also known as:DSA-6107-1ALPINE-CVE-2025-13878DEBIAN-CVE-2025-13878

Description

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

Affected packages (3)

Alpine/bindfrom 0, < 9.18.44-r0
Debian/bind9from 0, < 1:9.18.44-1~deb12u1
Debian/bind9from 0, < 1:9.18.44-1~deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2025-13878
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2025-13878