{"id":"CVE-2020-10772","aliases":["EUVD-2020-3186","GHSA-g6qm-p3jr-vj64","RHSA-2020:2642"],"status":"published","title":"An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as...","description":"An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01346,"percentile":0.71626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-406"],"published":"2020-11-27T17:40:05Z","modified":"2026-06-27T10:10:26Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-debuginfo","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-libs","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-devel","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-python","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-debuginfo","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-libs","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-devel","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-python","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-debuginfo","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-libs","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-devel","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-python","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-debuginfo","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-libs","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-devel","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-python","fixed_in":["0:1.6.6-5.el7_8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"unbound-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-5.el7_8"}]}]}],"products":[{"vendor":"nlnet labs","product":"unbound"},{"vendor":"nlnetlabs","product":"unbound"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1846026","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10772","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g6qm-p3jr-vj64"},{"url":"https://access.redhat.com/errata/RHSA-2020:2642","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2642.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10772","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-10772","description":"An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.","status":"published","published":"2020-11-27T17:40:05Z","modified":"2024-08-04T11:14:15.485Z","cwes":["CWE-406"],"updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2020-3186","description":"An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.","status":"published","published":"2020-11-27T17:40:05Z","modified":"2024-08-04T11:14:15Z","updated_at":"2026-11-03T03:07:48.918317Z"}],"ghsa":[{"id":"GHSA-g6qm-p3jr-vj64","title":"An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as...","description":"An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.","status":"published","published":"2022-05-24T17:35:00Z","modified":"2023-01-29T05:04:34Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:45:35.654176Z"}],"nvd":[{"id":"CVE-2020-10772","description":"An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbound could still amplify an incoming query into a large number of queries directed to a target, even with a lower amplification ratio compared to versions of Unbound that shipped before the mentioned erratum. This issue is about the incomplete fix for CVE-2020-12662, and it does not affect upstream versions of Unbound.","status":"published","published":"2020-11-27T18:15:11.44Z","modified":"2026-06-17T02:48:24.857Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-406","CWE-400"],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"RHSA-2020:2642","title":"Red Hat Security Advisory: unbound security update","status":"published","published":"2024-09-16T04:30:59Z","modified":"2026-06-27T10:10:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"}]}}