Skip to content
Fencer Intel
medium 5.3

CVE-2021-25219 json

Lame cache can be abused to severely degrade resolver performance

published 2021-10-27 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-12130

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
11.2%
EPSS 11.2% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

Patch / fix

  • isc bind 9.11.36, 9.16.22, 9.17.19
  • siemens sinec_infrastructure_network_services 1.0.1.1
  • bind9 Debian 14, Debian 13, Debian 12 1:9.17.19-1

debian advisories DEBIAN-CVE-2021-25219

  • bind9 Ubuntu 18.04 LTS 1:9.11.3+dfsg-1ubuntu1.16
  • bind9 Ubuntu 20.04 LTS 1:9.16.1-0ubuntu2.9
  • bind9 Ubuntu 22.04 LTS 1:9.16.15-1ubuntu2
  • bind9 Ubuntu Pro 14.04 LTS 1:9.9.5.dfsg-3ubuntu0.19+esm5
  • bind9 Ubuntu Pro 16.04 LTS 1:9.10.3.dfsg.P4-8ubuntu1.19+esm1

ubuntu advisories UBUNTU-CVE-2021-25219

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind RHEL 8 32:9.11.36-3.el8
  • bind-sdb RHEL 8 32:9.11.36-3.el8
  • bind-libs RHEL 8 32:9.11.36-3.el8
  • bind-utils RHEL 8 32:9.11.36-3.el8
  • bind-chroot RHEL 8 32:9.11.36-3.el8
  • bind-pkcs11 RHEL 8 32:9.11.36-3.el8
  • bind-license RHEL 8 32:9.11.36-3.el8
  • python3-bind RHEL 8 32:9.11.36-3.el8

red hat advisories RHSA-2022:2092

  • bind SLE Module for Server Applications 15 SP4, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 9.16.31-150400.5.6.1
  • bind SLE Module for Server Applications 15 SP3, SLE Module for Basesystem 15 SP3 9.16.6-150300.22.13.1
  • bind SLE Module for Server Applications 15 SP2, SLE Module for Basesystem 15 SP2 9.16.6-12.57.1
  • bind SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 9.11.22-3.37.1

suse advisories SUSE-SU-2022:2713-1SUSE-SU-2022:0151-1SUSE-SU-2021:3773-1SUSE-SU-2021:3657-1

  • bind openSUSE Tumbleweed 9.16.20-3.1
  • bind openSUSE Leap 15.3 9.16.6-150300.22.13.1
  • htmldoc Package Hub 15 SP3, openSUSE Leap 15.3 1.9.12-bp153.2.15.1
  • bind openSUSE Leap 15.2 9.16.6-lp152.14.25.1
  • bind openSUSE Leap 15.3 9.16.6-12.57.1

opensuse advisories openSUSE-SU-2024:11660-1openSUSE-SU-2022:0151-1openSUSE-SU-2021:1502-1openSUSE-SU-2021:3773-1

  • bind AlmaLinux 8 32:9.11.36-3.el8
  • bind-sdb AlmaLinux 8 32:9.11.36-3.el8
  • bind-libs AlmaLinux 8 32:9.11.36-3.el8
  • bind-utils AlmaLinux 8 32:9.11.36-3.el8
  • bind-chroot AlmaLinux 8 32:9.11.36-3.el8
  • bind-pkcs11 AlmaLinux 8 32:9.11.36-3.el8
  • bind-license AlmaLinux 8 32:9.11.36-3.el8
  • python3-bind AlmaLinux 8 32:9.11.36-3.el8

almalinux advisories ALSA-2022:2092

  • bind Rocky Linux 8 2:9.11.36-3.el8

rocky linux advisories RLSA-2022:2092

  • bind Alpine 3.12 9.16.27-r0
  • bind Alpine 3.14, Alpine 3.13 9.16.25-r0
  • bind Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 9.16.22-r0

alpine advisories ALPINE-CVE-2021-25219

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bind CBL-Mariner 2.0 9.16.29-1

azure linux advisories AZL-6327

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • bind Arch Linux 9.16.22-1

arch linux advisories AVG-2502

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-25219 updated cvss 5.3

bind: Lame cache can be abused to severely degrade resolver performance

  • Red Hat Enterprise Linux 6 bind, bind-sdb, bind-libs, bind-utils, bind-chroot Red Hat Enterprise Linux 7 bind, bind-sdb, bind-libs, bind-utils, bind-chroot, bind-pkcs11, +6 more
    affected: workaround, no fix planned “The vulnerability has been mitigated by changing the default value of lame-ttl to 0”
  • Red Hat Enterprise Linux AppStream (v. 8) bind 9.11.36-3.el8, bind-sdb 9.11.36-3.el8, bind-libs 9.11.36-3.el8, bind-utils 9.11.36-3.el8, bind-chroot 9.11.36-3.el8, bind-pkcs11 9.11.36-3.el8, +6 more Red Hat Enterprise Linux BaseOS (v. 8) bind 9.11.36-3.el8, bind-export-libs 9.11.36-3.el8
    fixed: vendor fix “The vulnerability has been mitigated by changing the default value of lame-ttl to 0” RHSA-2022:2092
  • Red Hat Enterprise Linux 9 bind, bind-libs, bind-utils, bind-chroot, bind-license, python3-bind, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

11.16% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • ISC BIND9

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.