CVE-2021-25214 — A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

Back Back to CVE browser

MEDIUM

A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

Published Apr 29, 2021

6.5

MEDIUM

CVSS 3.1

EPSS 5.99%

Description

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

Affected products

Vendor ISC Product BIND9 Default
n/a
- Version
  Development Branch 9.17 9.17.0 through versiosn before 9.17.12
  Status
  affected
  Constraints
  -
- Version
  Open Source Branch 9.8 9.8.5 through 9.8.8
  Status
  affected
  Constraints
  -
- Version
  Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14
  Status
  affected
  Constraints
  -
- Version
  Open Source Branches 9.9 through 9.11 9.9.3 through versions before 9.11.30
  Status
  affected
  Constraints
  -
- Version
  Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1
  Status
  affected
  Constraints
  -
- Version
  Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ISC

BIND9

n/a

Version	Status	Constraints
Development Branch 9.17 9.17.0 through versiosn before 9.17.12	affected	-
Open Source Branch 9.8 9.8.5 through 9.8.8	affected	-
Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14	affected	-
Open Source Branches 9.9 through 9.11 9.9.3 through versions before 9.11.30	affected	-
Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1	affected	-
Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1	affected	-

Red Hat Enterprise Linux 7

bind-32:9.11.4-26.P2.el7_9.7

Fixed · RHSA-2021:3325
Red Hat Enterprise Linux 8

bind-32:9.11.26-6.el8

Fixed · RHSA-2021:4384
Red Hat Enterprise Linux 8

bind-32:9.11.26-6.el8

Fixed · RHSA-2021:4384
Red Hat Enterprise Linux 5

bind

Not affected
Red Hat Enterprise Linux 5

bind97

Not affected
Red Hat Enterprise Linux 6

bind

Not affected
Red Hat Enterprise Linux 9

bind

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	bind-32:9.11.4-26.P2.el7_9.7	Fixed	RHSA-2021:3325
Red Hat Enterprise Linux 8	bind-32:9.11.26-6.el8	Fixed	RHSA-2021:4384
Red Hat Enterprise Linux 8	bind-32:9.11.26-6.el8	Fixed	RHSA-2021:4384
Red Hat Enterprise Linux 5	bind	Not affected	n/a
Red Hat Enterprise Linux 5	bind97	Not affected	n/a
Red Hat Enterprise Linux 6	bind	Not affected	n/a
Red Hat Enterprise Linux 9	bind	Not affected	n/a

Remediation

Vendor solution

Upgrade to the patched release most closely related to your current version of BIND:

BIND 9.11.31 BIND 9.16.15 BIND 9.17.12

BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.

BIND 9.11.31-S1 BIND 9.16.15-S1

Red Hat mitigation

Disabling incremental zone transfers (IXFR) by setting "request-ixfr no;" in the desired configuration block (options, zone, or server) prevents the failing assertion from being evaluated.

Metrics

5.99% 0.05989

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.05989

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (24 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	5.99% (0.05989)	93.09th	v5 (v2026.06.15)
Jun 15, 2026	5.94% (0.05940)	92.31th	v5 (v2026.06.15)
Jun 8, 2026	2.26% (0.02257)	84.92th	v4 (v2025.03.14)
Nov 21, 2025	1.01% (0.01013)	76.46th	v4 (v2025.03.14)
Nov 18, 2025	8.41% (0.08407)	91.44th	v4 (v2025.03.14)
Mar 17, 2025	0.64% (0.00635)	68.66th	v4 (v2025.03.14)
Dec 12, 2024	0.92% (0.00924)	83.62th	v3 (v2023.03.01)
Jul 13, 2024	0.92% (0.00924)	83.12th	v3 (v2023.03.01)
Nov 8, 2023	0.92% (0.00924)	81.12th	v3 (v2023.03.01)
Mar 28, 2023	1.03% (0.01031)	81.61th	v3 (v2023.03.01)
Mar 7, 2023	1.00% (0.01005)	81.34th	v3 (v2023.03.01)
Mar 6, 2023	2.81% (0.02812)	83.12th	v2 (v2022.01.01)
Apr 1, 2022	2.81% (0.02812)	81.44th	v2 (v2022.01.01)
Feb 4, 2022	22.60% (0.22604)	94.40th	v2 (v2022.01.01)
Feb 3, 2022	9.45% (0.09448)	86.95th	v1
Jan 6, 2022	9.45% (0.09448)	86.79th	v1
Sep 1, 2021	2.27% (0.02273)	77.89th	v1
May 21, 2021	2.27% (0.02273)	0.00th	v1
May 9, 2021	2.07% (0.02069)	0.00th	v1
May 7, 2021	1.86% (0.01865)	0.00th	v1
May 5, 2021	1.66% (0.01659)	0.00th	v1
May 2, 2021	1.45% (0.01454)	0.00th	v1
Apr 30, 2021	1.25% (0.01247)	0.00th	v1
Apr 29, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (1)

CWE-617

References (16)

http://www.openwall.com/lists/oss-security/2021/04/29/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/29/2
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/29/3
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/29/4
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2021-25214
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1953849
Issue Tracking
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
x_refsource_CONFIRMPatchThird Party Advisory
https://kb.isc.org/docs/cve-2021-25214
https://kb.isc.org/v1/docs/cve-2021-25214
x_refsource_CONFIRMVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/
vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2021-25214
https://security.netapp.com/advisory/ntap-20210521-0006/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-25214
https://www.debian.org/security/2021/dsa-4909
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2021/04/29/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/29/2		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/29/3		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/29/4		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2021-25214		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1953849		Issue Tracking
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf		x_refsource_CONFIRMPatchThird Party Advisory
https://kb.isc.org/docs/cve-2021-25214
https://kb.isc.org/v1/docs/cve-2021-25214		x_refsource_CONFIRMVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/		vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2021-25214
https://security.netapp.com/advisory/ntap-20210521-0006/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-25214
https://www.debian.org/security/2021/dsa-4909		vendor-advisoryx_refsource_DEBIANThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner isc

Published Apr 29, 2021

Updated Sep 17, 2024

Reserved Jan 15, 2021

Link CVE-2021-25214

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-25214

Red Hat

Severity Moderate

Public date Apr 28, 2021

Links CVE-2021-25214 - Bugzilla