7.5Yüksek

CVE-2021-25218A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in use

ISC BIND9 Yayım: 2021-08-18 21:20 (5 yıl önce)

Açıklama

In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.19, 9.17.16, and release 9.16.19-S1 of the BIND Supported Preview Edition.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
ISC	BIND9	Stable Branch 9.16.19, Development Branch 9.17.16, Supported Preview Edition 9.16.19-S1

Kaynaklar ve yamalar

CVSS puanı

7.5Yüksek

Kaynak: isc · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Yok
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (30 günde istismar olasılığı)

3.66%

tüm CVE'lerin %90'inden yüksek

Zaman çizelgesi

Numara ayrıldı2021-01-15
Yayımlandı2021-08-18 21:20
IP-DB'ye ulaştı2026-10-25 00:04
Son güncelleme2024-09-17 06:07

Numarayı veren (CNA): isc

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — ISC BIND 9

7.5Yüksek

CVE-2026-97313 16 gün önce

Specific RPZ configurations and query patterns may result in an unexpected exit

ISC BIND 9

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have …

7.5Yüksek

CVE-2026-96888 16 gün önce

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

ISC BIND 9

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through…

8.1Yüksek

CVE-2026-94300 16 gün önce

Concurrent GSS-TSIG messages corrupt memory

ISC BIND 9

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacke…

7.5Yüksek

CVE-2026-19630 16 gün önce

Amplified resource exhaustion in inbound message processing

ISC BIND 9

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate am…

5.9Orta

CVE-2026-77119 1 ay önce

NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

ISC BIND 9

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…

5.3Orta

CVE-2026-75029 1 ay önce

Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

ISC BIND 9

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …