CVE-2021-25219

Lame cache can be abused to severely degrade resolver performance

Medium · published October 27, 2021

CVSS v3.1
5.3
EPSS
11%
Percentile
95.8
In the wild
Unconfirmed
What it is

In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.10576 · 95.8th percentile
Published
2021-10-27T21:10Z
EPSS history
Timeline
  • 27 OCT 21:10Z
    Lame cache can be abused to severely degrade resolver performance
    cvelistv5