What’s Vulnerable › Vulnerabilities

CVE-2021-25220: DNS forwarders - cache poisoning vulnerability

• Severity: medium (CVSS 4.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-23 · updated 2026-06-17
• Weakness: CWE-444

Description

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.

Affected products

• Fedoraproject Fedora: 34, 35, 36
• ISC BIND: from 9.11.0 before 9.11.37; from 9.11.4 before 9.11.37; from 9.12.0 before 9.16.27; from 9.16.8 before 9.16.27; from 9.17.0 through 9.18.0 — fixed in 9.11.37, 9.16.27
• Juniper Junos OS: before 19.3; 19.3, 19.3-r1-s1, 19.3-r2, 19.3-r2-s1, 19.3-r2-s2, 19.3-r2-s3 (+104) — fixed in 19.3
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• Siemens SINEC INS: before 1.0; 1.0, 1.0-sp1 — fixed in 1.0

How to fix

Upgrade to a fixed version: ISC BIND 9.11.37, 9.16.27; Juniper Junos OS 19.3; Siemens SINEC INS 1.0. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://kb.isc.org/v1/docs/cve-2021-25220
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SXT7247QTKNBQ67MNRGZD23ADXU6E5U/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VX3I2U3ICOIEI5Y7OYA6CHOLFMNH3YQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/API7U5E7SX7BAAVFNW366FFJGD6NZZKV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DE3UAVCPUMAKG27ZL5YXSP2C3RIOW3JZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/
• https://security.gentoo.org/glsa/202210-25
• https://security.netapp.com/advisory/ntap-20220408-0001/
• https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://kb.isc.org/v1/docs/cve-2021-25220

Get alerted when CVE-2021-25220 or the next vulnerability affects your stack