An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.
- BDU:2021-02778
- DLA-2647-1
- DSA-4909-1
- openSUSE-SU-2021:0668-1
- openSUSE-SU-2021:1826-1
- RHSA-2021:1468
- RHSA-2021:1469
- RHSA-2021:1475
- RHSA-2021:1476
- RHSA-2021:1477
- RHSA-2021:1478
- RHSA-2021:1479
- RHSA-2021:1989
- RHSA-2021:2024
- RHSA-2021:2028
- RLSA-2021:1989
- SUSE-SU-2021:1468-1
- SUSE-SU-2021:1469-1
- SUSE-SU-2021:1471-1
- SUSE-SU-2021:14714-1
- Published
- Apr 28, 2021
- Updated
- Jun 16, 2026
- EPSS
- 11.4% · 96th percentile
- CWE
- CWE-617
Sign in to follow · You’ll be notified if a followed record enters KEV, gets an exploit or is updated.
Report tools
Action score
33
Monitor
Low priority for now.
- CVSS
- 30 / 40 · 7.5 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 3 / 30 · 11.4%
CNA vs NVD score
- NVD
- 7.5
- CNA · isc
- 7.5
- agree
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Affected systems
| Vendor | Product | CPE |
|---|---|---|
| debian | debian linux | cpe:2.3:o:debian:debian_linux |
| isc | bind | cpe:2.3:a:isc:bind |
| fedoraproject | fedora | cpe:2.3:o:fedoraproject:fedora |
| netapp | active iq unified manager | cpe:2.3:a:netapp:active_iq_unified_manager |
| netapp | cloud backup | cpe:2.3:a:netapp:cloud_backup |
| netapp | h300s firmware | cpe:2.3:o:netapp:h300s_firmware |
| netapp | h300s | cpe:2.3:h:netapp:h300s |
| netapp | h500s firmware | cpe:2.3:o:netapp:h500s_firmware |
| netapp | h500s | cpe:2.3:h:netapp:h500s |
| netapp | h700s firmware | cpe:2.3:o:netapp:h700s_firmware |
| netapp | h700s | cpe:2.3:h:netapp:h700s |
| netapp | h300e firmware | cpe:2.3:o:netapp:h300e_firmware |
and 13 more
Affected versions
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- debian debian linux10.0
- debian debian linux9.0
- fedoraproject fedora33
- fedoraproject fedora34
- isc bind9.12.0 and later · before 9.16.15
- isc bind9.0.0 and later · before 9.11.31
- isc bind9.17.0 and later · before 9.17.12
- isc bind9.10.5
- isc bind9.10.7
- isc bind9.11.12
- isc bind9.11.21
- isc bind9.11.27
- isc bind9.11.29
- isc bind9.11.3
- isc bind9.11.5
- isc bind9.11.6
- isc bind9.11.7
- isc bind9.11.8
- isc bind9.16.11
- isc bind9.16.13
Versions reported by the vendor
Affected version ranges reported by the assigning authority (isc). Independent of NVD's CPE analysis and usually ahead of it.
ISC BIND9
- Open Source Branches 9.0 through 9.11 9.0.0 through versions before 9.11.30, Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14, Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.14-S1, Development Branch 9.17 9.17.0 through versiosn before 9.17.12affected
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Alpine:v3.10 | bind | from 9.0.0 · before 9.16.15-r0 | 9.16.15-r0 |
| Debian:10 | bind9 | before 1:9.11.5.P4+dfsg-5.1+deb10u5 | 1:9.11.5.P4+dfsg-5.1+deb10u5 |
| Debian:12 | bind9 | before 1:9.16.15-1 | 1:9.16.15-1 |
| Debian:9 | bind9 | before 1:9.10.3.dfsg.P4-12.3+deb9u9 | 1:9.10.3.dfsg.P4-12.3+deb9u9 |
| openSUSE:Leap 15.2 | bind | before 9.16.6-lp152.14.19.1 | 9.16.6-lp152.14.19.1 |
| openSUSE:Leap 15.3 | bind | before 9.16.6-22.7.1 | 9.16.6-22.7.1 |
| Red Hat:enterprise_linux:7::client | bind | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-chroot | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-debuginfo | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-devel | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-export-devel | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-export-libs | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-libs | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-libs-lite | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-license | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-lite-devel | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-pkcs11 | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-pkcs11-devel | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-pkcs11-libs | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-pkcs11-utils | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-sdb | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-sdb-chroot | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:7::client | bind-utils | before 32:9.11.4-26.P2.el7_9.5 | 32:9.11.4-26.P2.el7_9.5 |
| Red Hat:enterprise_linux:8::appstream | bind | before 32:9.11.26-4.el8_4 | 32:9.11.26-4.el8_4 |
+96
Same product
debian: all recordsOther highest-scoring records for the same primary product.
- CVE-2016-9079A use-after-free vulnerability in SVG Animation has been discovered.KEV86Now
- CVE-2024-44308The issue was addressed with improved checks.KEV68This week
- CVE-2021-25216A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack64This week
- CVE-2024-44309A cookie management issue was addressed with improved state management.KEV62This week
- CVE-2016-2098Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rub53Plan
- CVE-2015-1592Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::t53Plan
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| alpine:bind | 9.16.15-r0 · Alpine:v3.10 | Package registry (OSV) |
| debian:bind9 | 1:9.16.15-1 · Debian:12 | Package registry (OSV) |
| opensuse:bind | 9.16.6-lp152.14.19.1 · openSUSE:Leap 15.2 | Package registry (OSV) |
| red hat:bind | 32:9.8.2-0.68.rc1.el6_10.11 · Red Hat:rhel_els:6 | Package registry (OSV) |
| red hat:bind-chroot | 32:9.8.2-0.68.rc1.el6_10.11 · Red Hat:rhel_els:6 | Package registry (OSV) |
| red hat:bind-debuginfo | 32:9.8.2-0.68.rc1.el6_10.11 · Red Hat:rhel_els:6 | Package registry (OSV) |
| red hat:bind-devel | 32:9.8.2-0.68.rc1.el6_10.11 · Red Hat:rhel_els:6 | Package registry (OSV) |
| red hat:bind-export-devel | 32:9.11.4-26.P2.el7_9.5 · Red Hat:enterprise_linux:7::client | Package registry (OSV) |
| red hat:bind-export-libs | 32:9.11.4-26.P2.el7_9.5 · Red Hat:enterprise_linux:7::client | Package registry (OSV) |
| red hat:bind-libs | 32:9.8.2-0.68.rc1.el6_10.11 · Red Hat:rhel_els:6 | Package registry (OSV) |
| red hat:bind-libs-lite | 32:9.11.4-26.P2.el7_9.5 · Red Hat:enterprise_linux:7::client | Package registry (OSV) |
| red hat:bind-license | 32:9.11.4-26.P2.el7_9.5 · Red Hat:enterprise_linux:7::client | Package registry (OSV) |
| red hat:bind-lite-devel | 32:9.11.4-26.P2.el7_9.5 · Red Hat:enterprise_linux:7::client | Package registry (OSV) |
| red hat:bind-sdb | 32:9.8.2-0.68.rc1.el6_10.11 · Red Hat:rhel_els:6 | Package registry (OSV) |
| red hat:bind-utils | 32:9.8.2-0.68.rc1.el6_10.11 · Red Hat:rhel_els:6 | Package registry (OSV) |
| rocky linux:bind | 2:9.11.26-4.el8_4 · Rocky Linux:8 | Package registry (OSV) |
| suse:bind | 9.11.22-3.34.1 · SUSE:OpenStack Cloud 9 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
No nightly-computed relations.
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
Technical details
Attack conditions
- Anyone who can reach it over the internet can trigger it.
- No account or password is required.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- none
- Integrity
- none
- Availability
- high · the service can be disrupted
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- None
- Availability impact
- High
Weakness class (CWE)
CWE-617 · Reachable AssertionCVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Noroxi analysis
No Noroxi analysis for this record yet
We don't hand-write analysis for all 385,000+ vulnerabilities; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.
We use this product, ask for helpChange log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
- www.openwall.com/lists/oss-security/2021/04/29/1
- www.openwall.com/lists/oss-security/2021/04/29/2
- www.openwall.com/lists/oss-security/2021/04/29/3
- www.openwall.com/lists/oss-security/2021/04/29/4
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- kb.isc.org/v1/docs/cve-2021-25215
- lists.debian.org/debian-lts-announce/2021/05/msg00001.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDSRPCJQ7MZC6CENH5PO3VQOFI7VSWBE/
- security.netapp.com/advisory/ntap-20210521-0006/
- www.debian.org/security/2021/dsa-4909
- www.oracle.com/security-alerts/cpuoct2021.html
Vendor advisories and official records. Exploit/PoC links are deliberately left out.