{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2021-25219",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2021-25219",
    "idYear": 2021,
    "status": "PUBLISHED",
    "publishedAt": "2021-10-27T21:10:10.088Z",
    "updatedAt": "2024-09-16T17:33:38.865Z",
    "importedAt": "2026-10-24T01:56:26.894Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Lame cache can be abused to severely degrade resolver performance",
      "summary": "In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND 9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing.",
      "affected": [
        {
          "vendor": "ISC",
          "product": "BIND9",
          "versions": [
            {
              "version": "Open Source Branches 9.3 through 9.11 9.3.0 through versions before 9.11.36",
              "status": "affected"
            },
            {
              "version": "Open Source Branches 9.12 through 9.16 9.12.0 through versions before 9.16.22",
              "status": "affected"
            },
            {
              "version": "Supported Preview Branches 9.9-S through 9.11-S 9.9.3-S1 through versions before 9.11.36-S1",
              "status": "affected"
            },
            {
              "version": "Supported Preview Branch 9.16-S 9.16.8-S1 through versions before 9.16.22-S1",
              "status": "affected"
            },
            {
              "version": "Development Branch 9.17 9.17.0 through versions before 9.17.19",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}