vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-25214

A broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly

MEDIUM
6.5
CVSS Score
Published: April 29, 2021 at 12:55 AM UTC
Updated: June 17, 2026 at 03:41 AM UTC
24 products affected across 5 vendorsDebian LinuxFedoraActive IQ Unified Manager

Using BIND9 by ISC?

Get instant alerts when new vulnerabilities affect BIND9 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 6%

Description

In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR triggering the flaw described above, the named process will terminate due to a failed assertion the next time the transferred secondary zone is refreshed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux· Debiandrupal
95%
10.09.0
Fedora· Fedora Projectrpm
95%
3334
BIND· Isc
95%
v ≤ 9.8.8v < 9.11.30v < 9.11.30-S1v < 9.16.14v < 9.16.14-S1v < 9.17.129.12.0 ≤ v < 9.16.159.17.0 ≤ v < 9.17.129.8.5 ≤ v ≤ 9.8.89.9.3 ≤ v < 9.11.319.10.5 s19.10.7 s19.11.12 s19.11.21 s19.11.27 s19.11.29 s19.11.3 s19.11.5 s39.11.5 s59.11.5 s69.11.6 s19.11.7 s19.11.8 s19.16.11 s19.16.13 s19.16.8 s19.9.12 s19.9.13 s19.9.3 s1
Affected range stops below 9.11.30, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.11.30-S1, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.11.31, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.16.14, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.16.14-S1, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.16.15, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.17.12, so it looks safe — our inference, not a vendor statement
Active IQ Unified Manager· NetAppnpm
95%
All versions
Aff 500F Firmware· NetApp
95%
All versions
netapp-aff-500f (same device)
Aff A250 Firmware· NetApp
95%
All versions
netapp-aff-a250 (same device)
Cloud Backup· NetAppdrupal
95%
All versions
H300E Firmware· NetAppdrupal
95%
All versions
netapp-h300e (same device)
H300S Firmware· NetAppdrupal
95%
All versions
netapp-h300s (same device)
H410S Firmware· NetAppdrupal
95%
All versions
netapp-h410s (same device)

References (11)

Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2021/04/29/1
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2021/04/29/2
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2021/04/29/3
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2021/04/29/4
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://kb.isc.org/v1/docs/cve-2021-25214
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2021/05/msg00001.html
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VEC2XG4Q2ODTN2C4CGXEIXU3EUTBMK7L/

CVSS

6.5MEDIUMisc
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-617

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card