Arch Linux Security Advisory ASA-202505-14 ========================================== Severity: High Date : 2025-05-21 CVE-ID : CVE-2025-40775 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2881 Summary ======= The package bind before version 9.20.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.20.9-1. # pacman -Syu "bind>=9.20.9-1" The problem has been fixed upstream in version 9.20.9. Workaround ========== None. Description =========== When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. Impact ====== A remote attacker can send a specially crafted DNS request leading to a denial of service. References ========== https://kb.isc.org/docs/cve-2025-40775 https://downloads.isc.org/isc/bind9/9.20.9/doc/arm/html/notes.html#security-fixes https://security.archlinux.org/CVE-2025-40775