An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself
Published Apr 29, 2021
7.5
HIGHCVSS 3.1
EPSS 11.39%
Description
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.
Affected products
-
- Version Development Branch 9.17 9.17.0 through versiosn before 9.17.12StatusaffectedConstraints-
- Version Open Source Branches 9.0 through 9.11 9.0.0 through versions before 9.11.30StatusaffectedConstraints-
- Version Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14StatusaffectedConstraints-
- Version Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1StatusaffectedConstraints-
- Version Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ISC | BIND9 | n/a |
|
Configuration 1
- 9.0
- 10.0
Configuration 2
- ≥ 9.0.0 · < 9.11.31
- ≥ 9.12.0 · < 9.16.15
- ≥ 9.17.0 · < 9.17.12
- 9.9.3
- 9.9.12
- 9.9.13
- 9.10.5
- 9.10.7
- 9.11.3
- 9.11.5
- 9.11.5
- 9.11.5
- 9.11.6
- 9.11.7
- 9.11.8
- 9.11.12
- 9.11.21
- 9.11.27
- 9.11.29
- 9.16.8
- 9.16.11
- 9.16.13
Configuration 3
- 33
- 34
Configuration 4
- n/a
- n/a
Configuration 5
- n/a
Configuration 6
- n/a
Configuration 7
- n/a
Configuration 8
- n/a
Configuration 9
- n/a
Configuration 10
- n/a
Configuration 11
- n/a
Configuration 12
- n/a
Configuration 13
- n/a
Configuration 14
- ≥ 7.4.0 · ≤ 7.7.1
Configuration 15
- < 1.0.1.1
No data.
Red Hat Enterprise Linux 6 Extended Lifecycle Support
bind-32:9.8.2-0.68.rc1.el6_10.11
Fixed · RHSA-2021:1468
Red Hat Enterprise Linux 7
bind-32:9.11.4-26.P2.el7_9.5
Fixed · RHSA-2021:1469
Red Hat Enterprise Linux 7.2 Advanced Update Support
bind-32:9.9.4-29.el7_2.11
Fixed · RHSA-2021:1476
Red Hat Enterprise Linux 7.3 Advanced Update Support
bind-32:9.9.4-50.el7_3.6
Fixed · RHSA-2021:1475
Red Hat Enterprise Linux 7.4 Advanced Update Support
bind-32:9.9.4-51.el7_4.6
Fixed · RHSA-2021:1479
Red Hat Enterprise Linux 7.4 Telco Extended Update Support
bind-32:9.9.4-51.el7_4.6
Fixed · RHSA-2021:1479
Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
bind-32:9.9.4-51.el7_4.6
Fixed · RHSA-2021:1479
Red Hat Enterprise Linux 7.6 Extended Update Support
bind-32:9.9.4-74.el7_6.7
Fixed · RHSA-2021:1478
Red Hat Enterprise Linux 7.7 Extended Update Support
bind-32:9.11.4-9.P2.el7_7.5
Fixed · RHSA-2021:1477
Red Hat Enterprise Linux 8
bind-32:9.11.26-4.el8_4
Fixed · RHSA-2021:1989
Red Hat Enterprise Linux 8
bind-32:9.11.26-4.el8_4
Fixed · RHSA-2021:1989
Red Hat Enterprise Linux 8.1 Extended Update Support
bind-32:9.11.4-26.P2.el8_1.5
Fixed · RHSA-2021:2028
Red Hat Enterprise Linux 8.2 Extended Update Support
bind-32:9.11.13-6.el8_2.3
Fixed · RHSA-2021:2024
Red Hat Enterprise Linux 5
bind
Out of support scope
Red Hat Enterprise Linux 5
bind97
Out of support scope
Red Hat Enterprise Linux 9
bind
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 Extended Lifecycle Support | bind-32:9.8.2-0.68.rc1.el6_10.11 | Fixed | RHSA-2021:1468 |
| Red Hat Enterprise Linux 7 | bind-32:9.11.4-26.P2.el7_9.5 | Fixed | RHSA-2021:1469 |
| Red Hat Enterprise Linux 7.2 Advanced Update Support | bind-32:9.9.4-29.el7_2.11 | Fixed | RHSA-2021:1476 |
| Red Hat Enterprise Linux 7.3 Advanced Update Support | bind-32:9.9.4-50.el7_3.6 | Fixed | RHSA-2021:1475 |
| Red Hat Enterprise Linux 7.4 Advanced Update Support | bind-32:9.9.4-51.el7_4.6 | Fixed | RHSA-2021:1479 |
| Red Hat Enterprise Linux 7.4 Telco Extended Update Support | bind-32:9.9.4-51.el7_4.6 | Fixed | RHSA-2021:1479 |
| Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions | bind-32:9.9.4-51.el7_4.6 | Fixed | RHSA-2021:1479 |
| Red Hat Enterprise Linux 7.6 Extended Update Support | bind-32:9.9.4-74.el7_6.7 | Fixed | RHSA-2021:1478 |
| Red Hat Enterprise Linux 7.7 Extended Update Support | bind-32:9.11.4-9.P2.el7_7.5 | Fixed | RHSA-2021:1477 |
| Red Hat Enterprise Linux 8 | bind-32:9.11.26-4.el8_4 | Fixed | RHSA-2021:1989 |
| Red Hat Enterprise Linux 8 | bind-32:9.11.26-4.el8_4 | Fixed | RHSA-2021:1989 |
| Red Hat Enterprise Linux 8.1 Extended Update Support | bind-32:9.11.4-26.P2.el8_1.5 | Fixed | RHSA-2021:2028 |
| Red Hat Enterprise Linux 8.2 Extended Update Support | bind-32:9.11.13-6.el8_2.3 | Fixed | RHSA-2021:2024 |
| Red Hat Enterprise Linux 5 | bind | Out of support scope | n/a |
| Red Hat Enterprise Linux 5 | bind97 | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | bind | Not affected | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade to the patched release most closely related to your current version of BIND:
BIND 9.11.31 BIND 9.16.15 BIND 9.17.12
BIND Supported Preview Edition is a special feature preview branch of BIND provided to eligible ISC support customers.
BIND 9.11.31-S1 BIND 9.16.15-S1
Red Hat mitigation
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (33 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 11.39% (0.11387) | 95.87th | v5 (v2026.06.15) |
| Jun 15, 2026 | 11.39% (0.11387) | 95.42th | v5 (v2026.06.15) |
| Jun 7, 2026 | 2.02% (0.02015) | 84.07th | v4 (v2025.03.14) |
| Dec 24, 2025 | 1.01% (0.01015) | 76.61th | v4 (v2025.03.14) |
| Nov 21, 2025 | 2.51% (0.02515) | 84.89th | v4 (v2025.03.14) |
| Nov 18, 2025 | 14.84% (0.14838) | 93.91th | v4 (v2025.03.14) |
| Mar 30, 2025 | 2.32% (0.02319) | 83.35th | v4 (v2025.03.14) |
| Mar 29, 2025 | 6.74% (0.06737) | 85.06th | v4 (v2025.03.14) |
| Mar 28, 2025 | 2.32% (0.02319) | 83.35th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.68% (0.00682) | 69.93th | v4 (v2025.03.14) |
| Dec 17, 2024 | 2.08% (0.02075) | 88.76th | v3 (v2023.03.01) |
| May 31, 2024 | 6.74% (0.06740) | 93.85th | v3 (v2023.03.01) |
| Mar 6, 2024 | 5.00% (0.05001) | 92.64th | v3 (v2023.03.01) |
| Jan 12, 2024 | 3.59% (0.03592) | 90.73th | v3 (v2023.03.01) |
| Dec 3, 2023 | 2.57% (0.02566) | 89.05th | v3 (v2023.03.01) |
| Nov 8, 2023 | 2.49% (0.02493) | 88.91th | v3 (v2023.03.01) |
| Nov 7, 2023 | 1.88% (0.01884) | 87.17th | v3 (v2023.03.01) |
| Mar 28, 2023 | 1.34% (0.01337) | 84.00th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.30% (0.01303) | 83.76th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.36% (0.03358) | 84.40th | v2 (v2022.01.01) |
| Apr 1, 2022 | 3.36% (0.03358) | 82.80th | v2 (v2022.01.01) |
| Feb 4, 2022 | 23.84% (0.23843) | 94.84th | v2 (v2022.01.01) |
| Feb 3, 2022 | 10.22% (0.10225) | 87.52th | v1 |
| Jan 6, 2022 | 10.22% (0.10225) | 87.37th | v1 |
| Oct 21, 2021 | 2.48% (0.02476) | 79.00th | v1 |
| Sep 1, 2021 | 2.27% (0.02273) | 77.89th | v1 |
| May 21, 2021 | 2.27% (0.02273) | 0.00th | v1 |
| May 9, 2021 | 2.07% (0.02069) | 0.00th | v1 |
| May 7, 2021 | 1.86% (0.01865) | 0.00th | v1 |
| May 5, 2021 | 1.66% (0.01659) | 0.00th | v1 |
| May 2, 2021 | 1.45% (0.01454) | 0.00th | v1 |
| Apr 30, 2021 | 1.25% (0.01247) | 0.00th | v1 |
| Apr 29, 2021 | 0.62% (0.00624) | 0.00th | v1 |
References (17)
- http://www.openwall.com/lists/oss-security/2021/04/29/1 mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/2 mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/3 mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/04/29/4 mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-25215 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1953857 Issue Tracking
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRMPatchThird Party Advisory
- https://kb.isc.org/docs/cve-2021-25215
- https://kb.isc.org/v1/docs/cve-2021-25215 x_refsource_CONFIRMVendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/ vendor-advisoryx_refsource_FEDORA
- https://nvd.nist.gov/vuln/detail/CVE-2021-25215
- https://security.netapp.com/advisory/ntap-20210521-0006/ x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-25215
- https://www.debian.org/security/2021/dsa-4909 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISCPatchThird Party Advisory
Change history (0)
No recorded changes yet.