CVE-2021-25215: Debian Linux
High severity, CVSS 7.5. EPSS: 11.4% chance of exploitation in the next 30 days.
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.
Affected products
- Debian Debian Linux: version 9.0 only; version 10.0 only
- Fedoraproject Fedora: version 33 only; version 34 only
- ISC BIND: from 9.0.0, before 9.11.31 (fixed in 9.11.31); from 9.12.0, before 9.16.15 (fixed in 9.16.15); from 9.17.0, before 9.17.12 (fixed in 9.17.12); version 9.9.3 only; version 9.9.12 only; version 9.9.13 only; …
- Netapp 500f Firmware: affected versions not specified
- Netapp a250 Firmware: affected versions not specified
- Netapp Active Iq Unified Manager: affected versions not specified
- Netapp Cloud Backup: affected versions not specified
- Netapp h300e Firmware: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500e Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700e Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Oracle Tekelec Platform Distribution: from 7.4.0, up to and including 7.7.1
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
Published 2021-04-29. Last modified 2026-06-17.