CVE-2025-13878

Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS probability

8.54%

CWE

CWE-617

Published

2026-01-21

Last modified

2026-09-01

Affected products

• ISC BIND 9
• ISC BIND 9
• ISC BIND 9
• ISC BIND 9
• ISC BIND 9

Weakness type

• CWE-617

Related vulnerabilities

• CVE-2026-24826 — Out-of-bounds write in turso3d
• CVE-2025-34458 — wb2osz/direwolf <= 1.8.1 Reachable Assertion DoS
• CVE-2025-41068 — Reachable Assertion vulnerability in Open5GS
• CVE-2025-41067 — Reachable Assertion vulnerability in Open5GS
• CVE-2026-34219 — libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow
• CVE-2026-63140 — Reachable Assertion in Elasticsearch Leading to Denial of Service
• CVE-2026-41584 — ZEBRA: rk Identity Point Panic in Transaction Verification
• CVE-2024-8361 — DoS caused due to wrong hash length returned for SHA2/224 algorithm

Markdown version · Browse all CVEs