CVE-2020-12662

7.5 highEPSS 3.2%

High (7.5). EPSS 3.2% chance of exploitation in the next 30 days.

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2020-05-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

canonical:ubuntu_linux
debian:debian_linux
fedoraproject:fedora
nlnetlabs:unbound
opensuse:leap

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html
http://www.nxnsattack.com
http://www.openwall.com/lists/oss-security/2020/05/19/5
https://lists.debian.org/debian-lts-announce/2021/02/msg00017.html

Check your stack JSON