Resource exhaustion via malformed DNSKEY handling
CVE: CVE-2025-8677
Component: bind
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-22T00:00:00+00:00

A vulnerability was found in BIND 9 resolvers, where processing malformed DNSKEY records from a specially crafted zone can lead to resource exhaustion, primarily causing excessive CPU utilization. This issue enables a remote, unauthenticated attacker to degrade resolver performance and potentially cause a denial of service (DoS) for legitimate DNS clients.

Statement: This vulnerability is considered Important because it allows a remote, unauthenticated attacker to cause significant CPU exhaustion on vulnerable BIND resolvers by serving zones containing malformed DNSKEY records. The flaw triggers excessive computational effort during DNSKEY validation, leading to degraded performance and potential denial of service for legitimate clients. However, the issue affects availability only—it does not enable code execution, data exposure, or privilege escalation—so it is not classified as critical. Furthermore, authoritative servers are not impacted, limiting the scope of exposure to recursive resolvers. While the attack is easy to launch and can disrupt DNS operations, its effect ceases once the malicious traffic stops, making prompt patching and recursive access control effective mitigations.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:9ea794d2dd24ff7377534edfb0447e5398a28919a84300cc79fe7bb8ae550d1b

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes

You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release is as follows:

      (For x86_64 architecture)
      The image digest is sha256:b373f9055bf22079e7baf0c7b3ea21067248932bb0ec57fa0af30c51810bbe91

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:9e91245847127c920394c66c06a2c5485a1e5e54c8254326f18c04fee139fb43

      (For s390x architecture)
      The image digest is sha256:cf49729558f112fb860b847d6a036b5545ecbf3d7ecce1107081251373be848e

      (For ppc64le architecture)
      The image digest is sha256:4bf0c14c8511361620a3d6c098f087ae6f4be7b4972314cadbabb3945f43b517

      (For aarch64 architecture)
      The image digest is sha256:279e8a5c8c3954f85de55780ac18e84cc21e052836131e921f1305094b1b4029

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.15 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:d517885ee59d46c2aca8be69fdcf916f78a510ae76a5a9f7875c1c5ab3cfc3c1

      (For s390x architecture)
      The image digest is sha256:3a4a7c87e8ca5f4e3803f8f203599b25055276a532df8e0b66ec4ec2ebc51f4c

      (For ppc64le architecture)
      The image digest is sha256:f34818181660a9f58a59e06dbe58f24de82dcbb688e5f940a41e62e08f1edf94

      (For aarch64 architecture)
      The image digest is sha256:24eeb2ea15ac709ed08df9b6f1a5d1ac334c4f7335c0ae5249e17298ab297517

All OpenShift Container Platform 4.15 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:283a4968c61885c67fd17ea4d6920b665c98d53fa85fc897e067d3c4c131da3b

      (For s390x architecture)
      The image digest is sha256:5db06d746a26930aa3a8ec756f77cfcf76bcfb838327a5c71d3a0e6d920b85c6

      (For ppc64le architecture)
      The image digest is sha256:444378df90349f12c84ec1447dfb2afa40fd28e6596d8d9ab9a37b9013fc6a62

      (For aarch64 architecture)
      The image digest is sha256:c837b6a0325105e8f1487cdebf12d1b41eaa609a88f37baf986f5361ba66b08b

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:d49a4f1a4532e3822e8769a97d87f538f9101701d3997e6e883c8abff7b58a43

      (For s390x architecture)
      The image digest is sha256:baded7c05358eda3d7bc20efdc3d2b963ba80f1639c2c80b2c58bc216a1375d1

      (For ppc64le architecture)
      The image digest is sha256:4714f7f59793e8f77cc5a95eb918bd43f9a6ff31de1b35fb59b45a07f7a3f118

      (For aarch64 architecture)
      The image digest is sha256:73e2429c13a91ea4e5031c61f94c57884a7251ece3e1bbb338523e7bf8246903

All OpenShift Container Platform 4.17 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:64e8c4cbd3199beb1ebb8d6a208cb81fdfe62f4e52d7586033f534d35f981244

      (For s390x architecture)
      The image digest is sha256:5b964fa43873a20a66b95769bbcd6c31b028f505281fb045bb3c2ed6ca114e91

      (For ppc64le architecture)
      The image digest is sha256:2108325c5ee08249e1b0c0ad6a3daab197f5e2a1a83c8600d27c49ad0ff94307

      (For aarch64 architecture)
      The image digest is sha256:b465cef295a81eaf055c87a9af6d8ecdcc11cb1e898895d6df527eb155a7ff82

All OpenShift Container Platform 4.18 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this  synchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:e4377ba202c97eccba15c3a428cd4e532a02d5420d5b8918cdd3284404abb1ba

      (For s390x architecture)
      The image digest is sha256:0a15e17381e77d0afdf331ae3c455e091ffd454cf69966f041abf28ad7494be9

      (For ppc64le architecture)
      The image digest is sha256:b7ec15e179936b7c832c59ee3e68c70151d16e5cb9270d1bd0f7fb6dd78e438c

      (For aarch64 architecture)
      The image digest is sha256:87fd3d95d4b0f67500c624b64a1bf69873a8ef361612fed314066f01b78677ec

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:2d228e6d0b5a5ef2d7eb40bc171ad44f06b990d7adb678914e5d9d047e72568d

      (For s390x architecture)
      The image digest is sha256:af6307b4034d762e4b50edfcbeff0bdd58d4530cecb960ad777fe977c5775d11

      (For ppc64le architecture)
      The image digest is sha256:7ce9923ffac52e14a5674744810689466a49479ace1525d96e1c81c6f4928eaf

      (For aarch64 architecture)
      The image digest is sha256:a1b224a91987e73d8e27b920b118fa13897c45d832fbdf38ec72d50d0e6cb8dc

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

To reduce risk, restrict recursive queries to trusted or internal networks only, and apply rate limiting or firewall rules to prevent excessive or repetitive requests. Enabling DNSSEC validation helps reject forged records, while isolating recursive resolvers from authoritative servers limits the impact of potential cache poisoning. Active monitoring of CPU usage, query volume, and cache anomalies can provide early warning of abuse or attacks.