Every CVE Search/ Get API key

CVE-2020-10772

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as...

7.5 HighFix available

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.35%Up 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.

Record
CVE-2020-10772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-406, CWE-400
Updated
2026-11-02
CVE List No score

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.

Record
CVE-2020-10772
Weakness
CWE-406
Updated
2026-11-02
EUVDEUVD-2020-3186 No score

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.

Record
EUVD-2020-3186
Updated
2026-11-03
GitHub AdvisoriesGHSA-g6qm-p3jr-vj64 No score

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as...

An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.

Record
GHSA-g6qm-p3jr-vj64
Weakness
CWE-400
Updated
2026-11-02
OSVRHSA-2020:2642 7.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2020:2642
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
unbound
Red Hat:enterprise_linux:7::client
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-libs
Red Hat:enterprise_linux:7::client
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-devel
Red Hat:enterprise_linux:7::client
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-python
Red Hat:enterprise_linux:7::client
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound
Red Hat:enterprise_linux:7::computenode
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-libs
Red Hat:enterprise_linux:7::computenode
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-python
Red Hat:enterprise_linux:7::computenode
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
Show 10 moreShow less
Affected packages
PackageAffectedFixed
unbound
Red Hat:enterprise_linux:7::server
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-libs
Red Hat:enterprise_linux:7::server
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-devel
Red Hat:enterprise_linux:7::server
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-python
Red Hat:enterprise_linux:7::server
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound
Red Hat:enterprise_linux:7::workstation
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-libs
Red Hat:enterprise_linux:7::workstation
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8
unbound-python
Red Hat:enterprise_linux:7::workstation
 before 0:1.6.6-5.el7_8
0:1.6.6-5.el7_8

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-10772 is a high vulnerability (CVSS 7.5) in Nlnet Labs Unbound, published November 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in unbound 0:1.6.6-5.el7_8.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open