Cyber Resilience

CVE-2025-8677

DoS

DoS
Published
22 October 2025
Modified
15 April 2026
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.11 96th percentile
Risk Priority 60 floored blend · peak EPSS

Summary

CVE-2025-8677 is a high-severity Amplification (CWE-405) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.

CWE(s)
CWE-405

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Malformed DNSKEY queries trigger application-layer CPU exhaustion in BIND (CWE-405), directly enabling T1499.004 Application or System Exploitation for Endpoint DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24324Shared CWE-405
CVE-2025-30204Shared CWE-405
CVE-2026-22775Shared CWE-405
CVE-2025-68480Shared CWE-405
CVE-2026-25611Shared CWE-405
CVE-2025-66506Shared CWE-405
CVE-2025-66564Shared CWE-405
CVE-2026-22774Shared CWE-405
CVE-2025-53633Shared CWE-405
CVE-2026-54224Shared CWE-405

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-5 Denial-of-service Protection
  • SI-10 Information Input Validation
  • SC-22 Architecture and Provisioning for Name/Address Resolution Service
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-5 Denial-of-service Protection good match
prevent

Directly requires mechanisms to protect against or limit effects of denial-of-service attacks, including resource exhaustion from crafted DNS queries.

SI-10 Information Input Validation good match
prevent

Requires validation of all inputs (here, DNSKEY records) to reject malformed data before it can trigger excessive CPU processing.

SC-22 Architecture and Provisioning for Name/Address Resolution Service partial match
prevent

Mandates secure architecture and provisioning choices for authoritative/caching name services that can limit exposure to malformed zone data.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-03 mostly match
prevents

Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.

PR.IR-04 mostly match
prevents

Capacity planning and monitoring maintain availability headroom against amplification attacks.

DE.CM-01 partial match
prevents

Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.

DE.CM-09 partial match
prevents

Runtime resource monitoring can surface excessive consumption yet does not enforce authorization or work proofs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.6 Capacity management none match
none

Stress-testing and demand-reduction tactics (e.g., bandwidth throttling) blunt amplification vectors that would otherwise let an attacker multiply resource consumption through a single request.

References