CVE-2021-25219
MEDIUMBIND <9.11.36 - DoS
Title source: llmDescription
In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.
References (10)
Scores
CVSS v3
5.3
EPSS
0.0071
EPSS Percentile
71.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Classification
Status
published
Affected Products (41)
isc/bind
< 9.11.36
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
isc/bind
... and 26 more
Timeline
Published
Oct 27, 2021
Tracked Since
Feb 18, 2026