7.5High

CVE-2020-8620

ISC BIND9 Published: 2020-08-21 23:50 (6 years ago)

Description

In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
ISC	BIND9	9.15.6

References and patches

https://kb.isc.org/docs/cve-2020-8620
https://security.netapp.com/advisory/ntap-20200827-0003/
USN-4468-1 vendor-advisory
GLSA-202008-19 vendor-advisory
https://www.synology.com/security/advisory/Synology_SA_20_19
openSUSE-SU-2020:1699 vendor-advisory
openSUSE-SU-2020:1701 vendor-advisory

CVSS score

7.5High

Source: isc · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (chance of exploitation in 30 days)

3.90%

higher than 90% of all CVEs

Timeline

ID reserved2020-02-05
Published2020-08-21 23:50
Reached IP-DB2026-10-25 00:04
Last updated2024-09-17 04:40

Assigned by (CNA): isc

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — ISC BIND 9

7.5High

CVE-2026-97313 21 days ago

Specific RPZ configurations and query patterns may result in an unexpected exit

ISC BIND 9

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have …

7.5High

CVE-2026-96888 21 days ago

Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

ISC BIND 9

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through…

8.1High

CVE-2026-94300 21 days ago

Concurrent GSS-TSIG messages corrupt memory

ISC BIND 9

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacke…

7.5High

CVE-2026-19630 21 days ago

Amplified resource exhaustion in inbound message processing

ISC BIND 9

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate am…

5.9Medium

CVE-2026-77119 1 month ago

NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets

ISC BIND 9

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged unsigned answer through. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21…

5.3Medium

CVE-2026-75029 1 month ago

Message parser retains every identical singleton RDATA, enabling wire-to-work amplification

ISC BIND 9

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory …