CVE-2020-8616
Estado: ModificadaAlta (8.6)—
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Puntuación base: 8.6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 11%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-400
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
- http://www.nxnsattack.com
- http://www.openwall.com/lists/oss-security/2020/05/19/4
- https://kb.isc.org/docs/cve-2020-8616
- https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/
- https://security.netapp.com/advisory/ntap-20200522-0002/
- https://usn.ubuntu.com/4365-1/
- https://usn.ubuntu.com/4365-2/
- https://www.debian.org/security/2020/dsa-4689
- https://www.synology.com/security/advisory/Synology_SA_20_12
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
- http://www.nxnsattack.com
- http://www.openwall.com/lists/oss-security/2020/05/19/4
- https://kb.isc.org/docs/cve-2020-8616
- https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/
- https://security.netapp.com/advisory/ntap-20200522-0002/
- https://usn.ubuntu.com/4365-1/
- https://usn.ubuntu.com/4365-2/
- https://www.debian.org/security/2020/dsa-4689
- https://www.synology.com/security/advisory/Synology_SA_20_12
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-8616",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-officer@isc.org",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-officer@isc.org",
"affectedData": [
{
"vendor": "ISC",
"product": "BIND9",
"versions": [
{
"status": "affected",
"version": "9.0.0 -> 9.11.18, 9.12.0 -> 9.12.4-P2, 9.14.0 -> 9.14.11, 9.16.0 -> 9.16.2, and releases 9.17.0 -> 9.17.1 of the 9.17 experimental development branch. All releases in the obsolete 9.13 and 9.15 development branches. All releases of BIND Supported Preview Edition from 9.9.3-S1 -> 9.11.18-S1"
}
]
}
]
}
],
"published": "2020-05-19T14:15:11.877",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html",
"source": "security-officer@isc.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html",
"source": "security-officer@isc.org"
},
{
"url": "http://www.nxnsattack.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2020/05/19/4",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://kb.isc.org/docs/cve-2020-8616",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html",
"source": "security-officer@isc.org"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/",
"source": "security-officer@isc.org"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/",
"source": "security-officer@isc.org"
},
{
"url": "https://security.netapp.com/advisory/ntap-20200522-0002/",
"source": "security-officer@isc.org"
},
{
"url": "https://usn.ubuntu.com/4365-1/",
"source": "security-officer@isc.org"
},
{
"url": "https://usn.ubuntu.com/4365-2/",
"source": "security-officer@isc.org"
},
{
"url": "https://www.debian.org/security/2020/dsa-4689",
"tags": [
"Third Party Advisory"
],
"source": "security-officer@isc.org"
},
{
"url": "https://www.synology.com/security/advisory/Synology_SA_20_12",
"source": "security-officer@isc.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.nxnsattack.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2020/05/19/4",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://kb.isc.org/docs/cve-2020-8616",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20200522-0002/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/4365-1/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/4365-2/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2020/dsa-4689",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.synology.com/security/advisory/Synology_SA_20_12",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor."
},
{
"lang": "es",
"value": "Un actor malicioso que explota intencionalmente esta falta de limitación efectiva en el número de recuperaciones realizadas cuando se procesan referencias puede, mediante el uso de referencias especialmente diseñadas, causar que un servidor recurrente emita una gran cantidad de recuperaciones en un intento de procesar la referencia. Esto tiene al menos dos efectos potenciales: el rendimiento del servidor recurrente puede estar potencialmente afectado por el trabajo adicional requerido para realizar estas recuperaciones, y el atacante puede explotar este comportamiento para utilizar el servidor recurrente como un reflector en un ataque de reflexión con un alto factor de amplificación"
}
],
"lastModified": "2026-06-17T03:26:38.913",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D09867AC-12F6-49C8-B399-0BA8B027B036",
"versionEndIncluding": "9.11.18",
"versionStartIncluding": "9.0.0"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C499955-0D38-4828-B94F-9BFE2719246B",
"versionEndIncluding": "9.12.4",
"versionStartIncluding": "9.12.0"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA8EE96D-C27B-4995-BFB2-B4AC55ACAE8A",
"versionEndIncluding": "9.13.7",
"versionStartIncluding": "9.13.0"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3296874E-8628-4D69-B788-6CC51296A522",
"versionEndIncluding": "9.14.11",
"versionStartIncluding": "9.14.0"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EEC8D4F0-B8E2-47B0-8E13-EE3FB4E43C01",
"versionEndIncluding": "9.15.6",
"versionStartIncluding": "9.15.0"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12DD0D57-81E0-40BC-8047-E41892261E39",
"versionEndIncluding": "9.16.2",
"versionStartIncluding": "9.16.0"
},
{
"criteria": "cpe:2.3:a:isc:bind:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96A5AA10-99B2-4784-A628-33E5CC697A30",
"versionEndIncluding": "9.17.1",
"versionStartIncluding": "9.17.0"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.12.4:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E121D018-42B7-467E-9481-EDA4021401AF"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.12.4:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "343890F9-D6B4-433C-9131-9526DBB75749"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:isc:bind:9.9.3:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40EE014B-0CD8-45F3-BEDB-AE6368A78B04"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.5:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAD41122-C5D8-4256-8CB7-FF88DCD96A13"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.10.7:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6243685F-1E5B-4FF6-AE1B-44798032FBA6"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.3:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2FE13E1-0646-46FC-875B-CB4C34E20101"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.5:s3:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AA16E51-819C-4A1B-B66E-1C60C1782C0D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.5:s5:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91533F9F-C0E5-4E84-8A4C-F744F956BF97"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.6:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AF9D390-0D5B-4963-A2D3-BF1E7CD95E9D"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.7:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB2B92F1-6BA8-41CA-9000-E0633462CC28"
},
{
"criteria": "cpe:2.3:a:isc:bind:9.11.8:s1:*:*:supported_preview:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02CA4635-7DFC-408E-A837-856E0F96CA1B"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-officer@isc.org"
}