CVE-2021-25215
bind: An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 28, 2021
Updated · November 22, 2025
Description
A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added more than once which causes an assertion check to fail. The highest threat from this flaw is to system availability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 · Reachable Assertion