Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-25219

23
FAUCET Score

CVE-2021-25219 is a performance degradation vulnerability affecting various versions of BIND 9, including the Supported Preview Edition and development branches. It arises from a flaw in response processing when interacting with broken authoritative servers, leading to an almost infinitely growing lame cache. This can cause significant delays in client query processing for affected products from vendors like Debian, Fedora, ISC, NetApp, Oracle, and Siemens. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with low complexity and no user interaction required, resulting in a low impact on availability. There is no known impact on confidentiality or integrity. Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public attention.

Impacted Technologies

VendorProductVersion(s)CPE
>= 9.3.0, < 9.11.36CPE matchmatch criteria
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
>= 9.12.0, < 9.16.22CPE matchmatch criteria
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
>= 9.17.0, < 9.17.19CPE matchmatch criteria
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:*
9.9.3CPE matchmatch criteria
cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*
9.9.12CPE matchmatch criteria
cpe:2.3:a:isc:bind:9.9.12:s1:*:*:supported_preview:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
8.00%
Probability of exploitation in next 30 days
EPSS Percentile
94.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0800 is in the 92nd percentile among its peer group of 23,684 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

microsoftpatch availablevia msrc
Product: 18760-16823Fixed in: 9.16.29-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 9.16.29-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 9.16.29-1
microsoftpatch availablevia msrc
Product: cbl2 bind 9.16.29-1 on CBL Mariner 2.0Fixed in: 9.16.29-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: bind-32:9.11.36-3.el8
View patch

Vendor Advisories (3)

microsoft2021-Dec/CVE-2021-25219

CVE-2021-25219

Dec 14, 2021
redhatCVE-2021-25219Moderate

bind: Lame cache can be abused to severely degrade resolver performance

Oct 27, 2021
microsoft2021-Oct/CVE-2021-25219Moderate

Lame cache can be abused to severely degrade resolver performance

Oct 12, 2021

References

cert-portal.siemens.com / productcert/pdf/ssa-389290.pdf
PatchThird Party Advisory
kb.isc.org / v1/docs/cve-2021-25219
Vendor Advisory
lists.debian.org / debian-lts-announce/2021/11/msg00001.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX
security.gentoo.org / glsa/202210-25
Third Party Advisory
security.netapp.com / advisory/ntap-20211118-0002
Third Party Advisory
debian.org / security/2021/dsa-4994
Third Party Advisory
oracle.com / security-alerts/cpuapr2022.html
Third Party Advisory