What’s Vulnerable › Vulnerabilities

CVE-2021-25219: Lame cache can be abused to severely degrade resolver performance

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-27 · updated 2026-06-17

Description

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Affected products

• Debian Linux: 9.0, 10.0, 11.0
• Fedoraproject Fedora: 33, 34, 35
• ISC BIND: from 9.3.0 before 9.11.36; from 9.12.0 before 9.16.22; from 9.17.0 before 9.17.19; 9.9.3-s1, 9.9.12-s1, 9.9.13-s1, 9.10.5-s1, 9.10.7-s1, 9.11.3-s1 (+15) — fixed in 9.11.36, 9.16.22, 9.17.19
• NetApp Cloud Backup: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• Oracle Corporation Oracle HTTP Server: 12.2.1.3.0, 12.2.1.4.0
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1

How to fix

Upgrade to a fixed version: ISC BIND 9.11.36, 9.16.22, 9.17.19; Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://kb.isc.org/v1/docs/cve-2021-25219
• https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
• https://security.gentoo.org/glsa/202210-25
• https://security.netapp.com/advisory/ntap-20211118-0002/
• https://www.debian.org/security/2021/dsa-4994
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://kb.isc.org/v1/docs/cve-2021-25219

Get alerted when CVE-2021-25219 or the next vulnerability affects your stack