When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure. This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bind | Aug 8, 2025 | May 21, 2025 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 21, 2025 |
| Debian | — | Upgrade bind9 | Jun 23, 2025 | May 21, 2025 |
| Dns Bind | — | Upgrade ISC BIND to latest version | Feb 20, 2026 | Feb 20, 2026 |
| Suse | — | Upgrade bindUpgrade bind-modules-perlUpgrade bind-utilsUpgrade bind-modules-genericUpgrade bind-modules-mysqlUpgrade bind-modules-sqlite3Upgrade bind-docUpgrade bind-modules-ldap | Dec 5, 2025 | May 30, 2025 |
| Ubuntu | — | Upgrade bind9 | May 22, 2025 | May 21, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | May 21, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub