Skip to content
CVE Tracker
Back

CVE-2021-25215

An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself

High7.5EPSS 11.7%
Published
Updated
Reserved
Assigned by
isc

Description

In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.

Scores

CVSS scores of CVE-2021-25215, by who scored it
Scored byCVSSScoreVector
iscCNA (assigner)3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Modified3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
11.7% · top 3.9% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

  • DNAME records, described in RFC 6672, provide a way to redirect a subtree of the domain name tree in the DNS. A flaw in the way named processes these records may trigger an attempt to add the same RRset to the ANSWER section more than once. This causes an assertion check in BIND to fail. DNAME records are processed by both authoritative and recursive servers. For authoritative servers, the DNAME record triggering the flaw can be retrieved from a zone database. For servers performing recursion, such a record is processed in the course of a query sent to an authoritative server. Affects BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch.
  • CWE-617 (opens in a new tab)

Affected products

  • ISC · BIND9

    • affected Open Source Branches 9.0 through 9.11 9.0.0 through versions before 9.11.30
    • affected Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14
    • affected Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1
    • affected Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1
    • affected Development Branch 9.17 9.17.0 through versiosn before 9.17.12

What to do

Solution: Upgrade to the patched release most closely related to your current version of BIND: BIND 9.11.31 BIND 9.16.15 BIND 9.17.12 BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers. BIND 9.11.31-S1 BIND 9.16.15-S1

Workaround: No workarounds known.

Exploitation: We are not aware of any active exploits.

References (12)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .