BIND, the DNS server implementation used in Red Hat Enterprise Linux, has been updated to fix two security vulnerabilities: CVE-2025-40780, which addresses cache poisoning due to a weak pseudo-random number generator, and CVE-2025-40778, which mitigates various DNS spoofing attacks. These vulnerabilities could allow attackers to inject malicious DNS records or spoof DNS responses. Red Hat has released updated packages for multiple architectures and product variants, including RHEL 9. The advisory RHSA-2025:19951 confirms the availability of these fixes and recommends applying them after prior errata are installed. No CVSS score is provided, but the severity is rated as important by Red Hat.

The vulnerabilities could enable cache poisoning and spoofing attacks against DNS servers running vulnerable versions of BIND on Red Hat Enterprise Linux. This may lead to DNS responses being manipulated, potentially redirecting users to malicious destinations. No known exploits are currently reported in the wild. The impact is significant enough for Red Hat to rate the update as important, indicating a high security risk if unpatched.

Red Hat has released official security updates that fix these vulnerabilities. Users should apply the provided BIND package updates for their specific Red Hat Enterprise Linux versions and architectures. Before applying this update, ensure all previously released errata relevant to the system are installed. Follow Red Hat's official guidance at https://access.redhat.com/articles/11258 for update procedures. No additional mitigation is required beyond applying the official patches.