{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2021-25220",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2021-25220",
    "idYear": 2021,
    "status": "PUBLISHED",
    "publishedAt": "2022-03-23T12:50:10.367Z",
    "updatedAt": "2024-09-16T17:08:54.143Z",
    "importedAt": "2026-10-24T01:56:26.894Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "DNS forwarders - cache poisoning vulnerability",
      "summary": "BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.",
      "affected": [
        {
          "vendor": "ISC",
          "product": "BIND",
          "versions": [
            {
              "version": "Open Source Branch 9.11  9.11.0 through versions before 9.11.37",
              "status": "affected"
            },
            {
              "version": "Development Branch 9.17  BIND 9.17 all version",
              "status": "affected"
            },
            {
              "version": "Open Source Branch 9.12-16  9.12.0 through versions before 9.16.27",
              "status": "affected"
            },
            {
              "version": "Open Source Branch 9.18 9.18.0",
              "status": "affected"
            },
            {
              "version": "Supported Preview Branch 9.11-S 9.11.0-S through versions before 9.11.37-S",
              "status": "affected"
            },
            {
              "version": "Supported Preview Branch 9.16-S  9.16.0-S through versions before 9.16.27-S",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}