CVE-2021-25219: Debian Linux
Medium severity, CVSS 5.3. EPSS: 10.6% chance of exploitation in the next 30 days.
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
Affected products
- Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
- Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
- ISC BIND: from 9.3.0, before 9.11.36 (fixed in 9.11.36); from 9.12.0, before 9.16.22 (fixed in 9.16.22); from 9.17.0, before 9.17.19 (fixed in 9.17.19); version 9.9.3 only; version 9.9.12 only; version 9.9.13 only; …
- Netapp Cloud Backup: affected versions not specified
- Netapp h300e Firmware: affected versions not specified
- Netapp h300s Firmware: affected versions not specified
- Netapp h410c Firmware: affected versions not specified
- Netapp h410s Firmware: affected versions not specified
- Netapp h500e Firmware: affected versions not specified
- Netapp h500s Firmware: affected versions not specified
- Netapp h700e Firmware: affected versions not specified
- Netapp h700s Firmware: affected versions not specified
- Oracle HTTP Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only
- Oracle ZFS Storage Appliance Kit: version 8.8 only
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
Published 2021-10-27. Last modified 2026-06-17.