CVE-2021-25214: Debian Linux
Medium severity, CVSS 6.5. EPSS: 6% chance of exploitation in the next 30 days.
In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.
Affected products
- Debian Debian Linux: version 9.0 only; version 10.0 only
- Fedoraproject Fedora: version 33 only; version 34 only
- ISC BIND: from 9.8.5, up to and including 9.8.8; from 9.9.3, before 9.11.31 (fixed in 9.11.31); from 9.12.0, before 9.16.15 (fixed in 9.16.15); from 9.17.0, before 9.17.12 (fixed in 9.17.12); version 9.9.3 only; version 9.9.12 only; …
- Netapp Active Iq Unified Manager: affected versions not specified
- Netapp Aff 500f Firmware: affected versions not specified
- Netapp Aff a250 Firmware: affected versions not specified
- Netapp Cloud Backup: affected versions not specified
- Netapp h300e Firmware: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500e Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700e Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
Published 2021-04-29. Last modified 2026-06-17.