Lame cache can be abused to severely degrade resolver performance
Published Oct 27, 2021
5.3
MEDIUMCVSS 3.1
EPSS 10.58%
Description
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
Affected products
-
- Version Development Branch 9.17 9.17.0 through versions before 9.17.19StatusaffectedConstraints-
- Version Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22StatusaffectedConstraints-
- Version Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36StatusaffectedConstraints-
- Version Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.22-S1StatusaffectedConstraints-
- Version Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ISC | BIND9 | n/a |
|
Configuration 1
- ≥ 9.3.0 · < 9.11.36
- ≥ 9.12.0 · < 9.16.22
- ≥ 9.17.0 · < 9.17.19
- 9.9.3
- 9.9.12
- 9.9.13
- 9.10.5
- 9.10.7
- 9.11.3
- 9.11.5
- 9.11.5
- 9.11.5
- 9.11.6
- 9.11.7
- 9.11.8
- 9.11.12
- 9.11.21
- 9.11.27
- 9.11.29
- 9.11.35
- 9.16.8
- 9.16.11
- 9.16.13
- 9.16.21
Configuration 2
- 9.0
- 10.0
- 11.0
Configuration 3
- 33
- 34
- 35
Configuration 4
- n/a
Configuration 5
- n/a
Configuration 6
- n/a
Configuration 7
- n/a
Configuration 8
- n/a
Configuration 9
- n/a
Configuration 10
- n/a
Configuration 11
- n/a
Configuration 12
- n/a
Configuration 13
- < 1.0.1.1
Configuration 14
- 12.2.1.3.0
- 12.2.1.4.0
- 8.8
No data.
Red Hat Enterprise Linux 8
bind-32:9.11.36-3.el8
Fixed · RHSA-2022:2092
Red Hat Enterprise Linux 8
bind-32:9.11.36-3.el8
Fixed · RHSA-2022:2092
Red Hat Enterprise Linux 6
bind
Out of support scope
Red Hat Enterprise Linux 7
bind
Out of support scope
Red Hat Enterprise Linux 9
bind
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | bind-32:9.11.36-3.el8 | Fixed | RHSA-2022:2092 |
| Red Hat Enterprise Linux 8 | bind-32:9.11.36-3.el8 | Fixed | RHSA-2022:2092 |
| Red Hat Enterprise Linux 6 | bind | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | bind | Out of support scope | n/a |
| Red Hat Enterprise Linux 9 | bind | Not affected | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade to the patched release most closely related to your current version of BIND: BIND 9.11.36, BIND 9.16.22, BIND 9.17.19, or for BIND Supported Preview Edition (a special feature preview branch of BIND provided to eligible ISC support customers): BIND 9.11.36-S1, BIND 9.16.22-S1.
Red Hat mitigation
The vulnerability has been mitigated by changing the default value of lame-ttl to 0
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (31 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 10.58% (0.10576) | 95.65th | v5 (v2026.06.15) |
| Aug 20, 2026 | 10.58% (0.10576) | 95.42th | v5 (v2026.06.15) |
| Jun 23, 2026 | 8.00% (0.08001) | 94.01th | v5 (v2026.06.15) |
| Jun 15, 2026 | 12.90% (0.12899) | 95.79th | v5 (v2026.06.15) |
| Nov 21, 2025 | 0.71% (0.00708) | 71.45th | v4 (v2025.03.14) |
| Nov 18, 2025 | 8.07% (0.08069) | 91.26th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.50% (0.00498) | 63.78th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.71% (0.00707) | 81.06th | v3 (v2023.03.01) |
| Jul 12, 2024 | 0.71% (0.00707) | 80.57th | v3 (v2023.03.01) |
| Jun 2, 2024 | 0.50% (0.00499) | 76.30th | v3 (v2023.03.01) |
| May 7, 2024 | 0.48% (0.00484) | 75.85th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.34% (0.00341) | 70.67th | v3 (v2023.03.01) |
| Jan 19, 2024 | 0.34% (0.00341) | 68.53th | v3 (v2023.03.01) |
| Nov 8, 2023 | 0.24% (0.00240) | 61.83th | v3 (v2023.03.01) |
| May 20, 2023 | 0.29% (0.00291) | 64.48th | v3 (v2023.03.01) |
| May 8, 2023 | 0.41% (0.00413) | 70.11th | v3 (v2023.03.01) |
| Apr 9, 2023 | 0.27% (0.00270) | 62.83th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.19% (0.00190) | 54.70th | v3 (v2023.03.01) |
| Mar 6, 2023 | 6.28% (0.06277) | 90.76th | v2 (v2022.01.01) |
| Apr 20, 2022 | 6.28% (0.06277) | 89.95th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.60% (0.02596) | 80.30th | v2 (v2022.01.01) |
| Mar 9, 2022 | 27.60% (0.27597) | 95.95th | v2 (v2022.01.01) |
| Feb 4, 2022 | 21.91% (0.21906) | 94.30th | v2 (v2022.01.01) |
| Feb 3, 2022 | 7.04% (0.07038) | 83.71th | v1 |
| Jan 6, 2022 | 7.04% (0.07038) | 83.55th | v1 |
| Nov 18, 2021 | 1.66% (0.01659) | 74.52th | v1 |
| Nov 11, 2021 | 1.45% (0.01454) | 72.53th | v1 |
| Nov 4, 2021 | 1.04% (0.01040) | 65.13th | v1 |
| Nov 2, 2021 | 0.83% (0.00833) | 58.15th | v1 |
| Oct 29, 2021 | 0.62% (0.00624) | 45.58th | v1 |
| Oct 28, 2021 | 0.42% (0.00416) | 25.89th | v1 |
References (14)
- https://access.redhat.com/security/cve/CVE-2021-25219 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2017636 Issue Tracking
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf PatchThird Party Advisory
- https://kb.isc.org/v1/docs/cve-2021-25219 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html mailing-listMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-25219
- https://security.gentoo.org/glsa/202210-25 vendor-advisoryThird Party Advisory
- https://security.netapp.com/advisory/ntap-20211118-0002/ Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-25219
- https://www.debian.org/security/2021/dsa-4994 vendor-advisoryThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
Change history (0)
No recorded changes yet.