CVE-2020-10995
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against...
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
CVE-2020-10995- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
CVE-2020-10995- Updated
- 2026-11-02
EUVDEUVD-2020-3392 No score
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
EUVD-2020-3392- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g5gv-j2x8-cxr2
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against...
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
GHSA-g5gv-j2x8-cxr2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-674
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-10995
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
ALPINE-CVE-2020-10995- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
CVE-2020-10995- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2020-10995
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
DEBIAN-CVE-2020-10995- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-10995
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
- Record
UBUNTU-CVE-2020-10995- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0223 No score
Updated pdns-recursor packages fix security vulnerabilities
Updated pdns-recursor packages fix security vulnerabilities:
An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect (CVE-2020-10995).
An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation (CVE-2020-12244).
- Record
MGASA-2020-0223- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0698-1 No score
Security update for pdns-recursor
This update for pdns-recursor fixes the following issues:
- update to 4.1.16
- fixes an issue where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated (CVE-2020-12244, boo#1171553)
- fixes an issue where invalid hostname on the server can result in disclosure of invalid memory (CVE-2020-10030, boo#1171553)
- fixes an issue in the DNS protocol has been found that allows malicious parties to use recursive DNS services to attack third party authoritative name servers (CVE-2020-10995, boo#1171553)
For details see https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16
- Record
openSUSE-SU-2020:0698-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11157-1 No score
pdns-recursor-4.5.5-1.3 on GA media
These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11157-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.10 |
before 4.1.16-r0 | 4.1.16-r0 |
pdns-recursorAlpine:v3.11 |
before 4.2.2-r0 | 4.2.2-r0 |
pdns-recursorAlpine:v3.12 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.13 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.14 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.15 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.16 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.17 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.18 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.19 |
before 4.3.1-r0 | 4.3.1-r0 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pdns-recursorAlpine:v3.20 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.21 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.22 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.23 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.24 |
before 4.3.1-r0 | 4.3.1-r0 |
pdns-recursorAlpine:v3.9 |
before 4.1.16-r0 | 4.1.16-r0 |
pdns-recursorDebian:12 |
before 4.3.1-1 | 4.3.1-1 |
pdns-recursorDebian:13 |
before 4.3.1-1 | 4.3.1-1 |
pdns-recursorDebian:14 |
before 4.3.1-1 | 4.3.1-1 |
pdns-recursorDebian:10 |
before 4.1.11-1+deb10u1, plus listed versions 4.1.11-1 |
4.1.11-1+deb10u1 |
pdns-recursorMageia:7 |
before 4.1.16-1.mga7 | 4.1.16-1.mga7 |
pdns-recursorUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1 |
None known |
pdns-recursorUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1 |
None known |
pdns-recursorUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1 |
None known |
pdns-recursorSUSE:Package Hub 12 SP1 |
before 4.1.12-bp151.4.3.1 | 4.1.12-bp151.4.3.1 |
pdns-recursorSUSE:Package Hub 15 SP1 |
before 4.1.12-bp151.4.3.1 | 4.1.12-bp151.4.3.1 |
pdns-recursoropenSUSE:Leap 15.1 |
before 4.1.12-bp151.4.3.1 | 4.1.12-bp151.4.3.1 |
pdns-recursoropenSUSE:Tumbleweed |
before 4.5.5-1.3 | 4.5.5-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10995 is a high vulnerability (CVSS 7.5) in Powerdns Recursor, published May 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.48%, the 91st percentile. Fixed in pdns-recursor 4.1.16-r0.
References
nxnsattack.com
doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html
debian.org/security/2020/dsa-4691
lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF
Show 34 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-10995
github.com/advisories/GHSA-g5gv-j2x8-cxr2
security.alpinelinux.org/vuln/CVE-2020-10995
security-tracker.debian.org/tracker/CVE-2020-10995
advisories.mageia.org/MGASA-2020-0223.html
bugs.mageia.org/show_bug.cgi?id=26645
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html
openwall.com/lists/oss-security/2020/05/19/3
ubuntu.com/security/CVE-2020-10995
cve.org/CVERecord?id=CVE-2020-10995
bugzilla.suse.com/1171553
suse.com/security/cve/CVE-2020-10030