Description
In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record triggering the flaw described above, the named process will terminate due to a failed assertion check. The vulnerability affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other versions of BIND 9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ISC | BIND9 | Open Source Branches 9.0 through 9.11 9.0.0 through versions before 9.11.30, Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.14, Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.30-S1, Supported Preview Branch 9.16-S 9.16.8-S1 through … | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bind9 | 1:9.16.15-1 | — |
| Debian 13 | bind9 | 1:9.16.15-1 | — |
| Debian 12 | bind9 | 1:9.16.15-1 | — |
| Debian 10 | bind9 | 1:9.11.5.P4+dfsg-5.1+deb10u5 | DSA-4909-1 |
| Debian 9 | bind9 | 1:9.10.3.dfsg.P4-12.3+deb9u9 | DLA-2647-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | bind9 | 1:9.16.1-0ubuntu2.8 | USN-4929-1 |
| Ubuntu 18.04 LTS | bind9 | 1:9.11.3+dfsg-1ubuntu1.15 | USN-4929-1 |
| Ubuntu 16.04 LTS | bind9 | 1:9.10.3.dfsg.P4-8ubuntu1.19 | USN-4929-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | bind9 | 1:9.9.5.dfsg-3ubuntu0.19+esm13 | USN-7739-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | bind +16 | 32:9.11.26-4.el8_4 | RHSA-2021:1989 |
| RHEL 7 | bind +15 | 32:9.11.4-26.P2.el7_9.5 | RHSA-2021:1469 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.2 EUS | bind +16 | 32:9.11.13-6.el8_2.3 | RHSA-2021:2024 |
| RHEL 8.1 EUS | bind +16 | 32:9.11.4-26.P2.el8_1.5 | RHSA-2021:2028 |
| RHEL 7.7 EUS | bind +15 | 32:9.11.4-9.P2.el7_7.5 | RHSA-2021:1477 |
| RHEL 7.6 EUS | bind +13 | 32:9.9.4-74.el7_6.7 | RHSA-2021:1478 |
| RHEL 7.4 TUS | bind +13 | 32:9.9.4-51.el7_4.6 | RHSA-2021:1479 |
| RHEL 7.4 E4S | bind +13 | 32:9.9.4-51.el7_4.6 | RHSA-2021:1479 |
| RHEL 7.4 AUS | bind +13 | 32:9.9.4-51.el7_4.6 | RHSA-2021:1479 |
| RHEL 7.3 AUS | bind +13 | 32:9.9.4-50.el7_3.6 | RHSA-2021:1475 |
| RHEL 7.2 AUS | bind +13 | 32:9.9.4-29.el7_2.11 | RHSA-2021:1476 |
| RHEL 6 ELS | bind +5 | 32:9.8.2-0.68.rc1.el6_10.11 | RHSA-2021:1468 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | bind | 2:9.11.26-4.el8_4 | RLSA-2021:1989 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | bind | 9.16.6-22.7.1 | SUSE-SU-2021:1826-1 |
| SLES 15 SP2 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SLES 15 SP1 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SLES 15 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SLES 12 SP5 | bind | 9.11.22-3.34.1 | SUSE-SU-2021:1468-1 |
Show 21 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | bind | 9.11.22-3.34.1 | SUSE-SU-2021:1468-1 |
| SLES 12 SP3 | bind | 9.9.9P1-63.25.1 | SUSE-SU-2021:1469-1 |
| SLES 12 SP2 | bind | 9.9.9P1-63.25.1 | SUSE-SU-2021:1469-1 |
| SLES 11 SP4 | bind | 9.9.6P1-0.51.26.1 | SUSE-SU-2021:14714-1 |
| SLES for SAP 15 SP1 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SLES for SAP 15 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SLES for SAP 12 SP5 | bind | 9.11.22-3.34.1 | SUSE-SU-2021:1468-1 |
| SLES for SAP 12 SP4 | bind | 9.11.22-3.34.1 | SUSE-SU-2021:1468-1 |
| SLES for SAP 12 SP3 | bind | 9.9.9P1-63.25.1 | SUSE-SU-2021:1469-1 |
| SLE HPC 15 SP1 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SLE HPC 15 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SUSE OpenStack Cloud Crowbar 9 | bind | 9.11.22-3.34.1 | SUSE-SU-2021:1468-1 |
| SUSE OpenStack Cloud Crowbar 8 | bind | 9.9.9P1-63.25.1 | SUSE-SU-2021:1469-1 |
| SUSE OpenStack Cloud 9 | bind | 9.11.22-3.34.1 | SUSE-SU-2021:1468-1 |
| SUSE OpenStack Cloud 8 | bind | 9.9.9P1-63.25.1 | SUSE-SU-2021:1469-1 |
| SUSE Manager Server 4.0 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SUSE Manager Retail Branch Server 4.0 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SUSE Manager Proxy 4.0 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | bind | 9.9.6P1-0.51.26.1 | SUSE-SU-2021:14714-1 |
| SUSE HPE Helion OpenStack 8 | bind | 9.9.9P1-63.25.1 | SUSE-SU-2021:1469-1 |
| SUSE Enterprise Storage 6 | bind | 9.16.6-12.49.1 | SUSE-SU-2021:1471-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bind | 9.16.20-1.4 | openSUSE-SU-2024:10650-1 |
| openSUSE Leap 15.3 | bind | 9.16.6-22.7.1 | openSUSE-SU-2021:1826-1 |
| openSUSE Leap 15.2 | bind | 9.16.6-lp152.14.19.1 | openSUSE-SU-2021:0668-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | bind | 9.16.15-r0 | — |
| Alpine v3.23 | bind | 9.16.15-r0 | — |
| Alpine v3.22 | bind | 9.16.15-r0 | — |
| Alpine v3.21 | bind | 9.16.15-r0 | — |
| Alpine v3.20 | bind | 9.16.15-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | bind | 9.16.15-r0 | — |
| Alpine v3.18 | bind | 9.16.15-r0 | — |
| Alpine v3.17 | bind | 9.16.15-r0 | — |
| Alpine v3.16 | bind | 9.16.15-r0 | — |
| Alpine v3.15 | bind | 9.16.15-r0 | — |
| Alpine v3.14 | bind | 9.16.15-r0 | — |
| Alpine v3.13 | bind | 9.16.15-r0 | — |
| Alpine v3.12 | bind | 9.16.15-r0 | — |
| Alpine v3.11 | bind | 9.16.15-r0 | — |
| Alpine v3.10 | bind | 9.16.15-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | bind +15 | 32:9.11.4-26.P2.amzn2.5 | ALAS2-2021-1635 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | bind +16 | 32:9.11.26-4.el8_4 | ELSA-2021-1989 |
| Oracle Linux 7 | bind +15 | 32:9.11.4-26.P2.el7_9.5 | ELSA-2021-1469 |
Advisories 29
- RHSA-2021:1475 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1479 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1468 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1469 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1476 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1478 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:2028 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1477 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:1989 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2021:2024 Red Hat Security Advisory: bind security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-7739-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-4929-1 bind9 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4909-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2647-1 bind9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2021:1989 Important: bind security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2021:1469-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1471-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1468-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1826-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10650-1 bind-9.16.20-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1826-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0668-1 Security update for bind SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2027 Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Sep 10, 2025
- ICSA-22-069-09 Siemens SINEC INS CISA ICS & IT advisories · May 6, 2025
- SUSE-SU-2021:14714-1 Security update for bind SUSE / openSUSE Security Updates · May 2, 2025
- SSA-389290 SSA-389290: Third-Party Component Vulnerabilities in SINEC INS Siemens ProductCERT · Mar 8, 2022
- ELSA-2021-1989 Important: bind security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 26, 2021
- ALAS2-2021-1635 Important: bind security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 24, 2021
- ELSA-2021-1469 Important: bind security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 30, 2021
References
- https://kb.isc.org/v1/docs/cve-2021-25215
- [oss-security] 20210428 ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list
- [oss-security] 20210429 Re: ISC discloses three BIND vulnerabilities (CVE-2021-25214, CVE-2021-25215, and CVE-2021-25216) mailing-list
- DSA-4909 vendor-advisory
- [debian-lts-announce] 20210504 [SECURITY] [DLA 2647-1] bind9 security update mailing-list
- FEDORA-2021-ace61cbee1 vendor-advisory
- FEDORA-2021-47f23870ec vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210521-0006/
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf