8.6

CVE-2020-8616: BIND does not sufficiently limit the number of fetches performed when processing referrals

Modified
AliasesALPINE-CVE-2020-8616RHSA-2020:3272UBUNTU-CVE-2020-8616
Published 19-05-2020Last modified 16-09-2024

Vulnerability summary

CVE-2020-8616 is a high (CVSS 8.6) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 10.88% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.6/10
010
High · v3.1 (CVE.org)
EPSS score
10.88%
0%100%
Medium · +0.29 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 23 · Related 11
DLA-2227-1DSA-4689-1MGASA-2020-0259OPENSUSE-SU-2020:1699-1OPENSUSE-SU-2020:1701-1OPENSUSE-SU-2024:10650-1

Timeline

  1. 19-05-2020
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

10.88%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Increase +0.29 pp

From 10.59% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (nxnsattack.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat17 products
  • bind< 32:9.11.4-9.P2.el7_7.2
  • bind-chroot< 32:9.11.4-9.P2.el7_7.2
  • bind-debuginfo< 32:9.11.4-9.P2.el7_7.2
  • bind-devel< 32:9.11.4-9.P2.el7_7.2
  • bind-export-devel< 32:9.11.4-9.P2.el7_7.2
Debian2 products
Isc2 products
  • bind≥ 9.0.0, ≤ 9.11.18 | ≥ 9.12.0, ≤ 9.12.4 | ≥ 9.13.0, ≤ 9.13.7 | ≥ 9.14.0, ≤ 9.14.11 | ≥ 9.15.0, ≤ 9.15.6 | ≥ 9.16.0, ≤ 9.16.2 | ≥ 9.17.0, ≤ 9.17.1 | 9.12.4:p1 | 9.12.4:p2 | 9.9.3:s1 | 9.10.5:s1 | 9.10.7:s1 | 9.11.3:s1 | 9.11.5:s3 | 9.11.5:s5 | 9.11.6:s1 | 9.11.7:s1 | 9.11.8:s1
  • bind99.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1
Alpine1 product
  • bind≥ 9.0.0, < 9.14.12-r0
Chainguard1 product
  • bindAll versions (No fix recorded)
Ubuntu1 product
  • bind9< 1:9.9.5.dfsg-3ubuntu0.19+esm2 | < 1:9.10.3.dfsg.P4-8ubuntu1.16 | < 1:9.11.3+dfsg-1ubuntu1.12 | < 1:9.16.1-0ubuntu2.1
Wolfi1 product
  • bindAll versions (No fix recorded)

7 vendors · 25 products

References

26 links
Show all 26 references