CVE-2021-25216

CWE-125 — Out-of-bounds ReadCWE-131CWE-190 — Integer OverflowCWE-617 — Reachable Assertion9 documents8 sources
Severity
9.8CRITICAL
EPSS
27.7%
top 3.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
ISC BindSiemens Sinec Infrastructure Network ServicesISC Bind9+1 more
Timeline
PublishedApr 29
Latest updateSep 8

Description

In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly settin…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages4 packages

▶NVDisc/bind9.0.0 — 9.11.31+19
▶Debianbind9< 1:9.16.15-1+3
▶CVEListV5isc/bind95 versions+4

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-4vh7-r4m9-4w3v: In BIND 9↗2022-05-24
▶
OSV
CVE-2021-25216: In BIND 9↗2021-04-29
▶
CVEList
A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack↗2021-04-29
▶
OSV
bind9 vulnerabilities↗2021-04-29
▶

📋Vendor Advisories

4
Ubuntu
Bind vulnerabilities↗2025-09-08
▶
Red Hat
bind: Vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack↗2021-04-28
▶
Microsoft
A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack↗2021-04-13
▶
Debian
CVE-2021-25216: bind9 - In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11...↗2021
▶
CVE-2021-25216 (CRITICAL CVSS 9.8) | In BIND 9.5.0 -> 9.11.29 | cvebase.io