{"id":"CVE-2020-10995","aliases":["ALPINE-CVE-2020-10995","DEBIAN-CVE-2020-10995","DSA-4691-1","EUVD-2020-3392","GHSA-g5gv-j2x8-cxr2","MGASA-2020-0223","UBUNTU-CVE-2020-10995","openSUSE-SU-2020:0698-1","openSUSE-SU-2024:11157-1"],"status":"published","title":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against...","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.04481,"percentile":0.91587,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-674"],"published":"2020-05-19T12:00:00Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"pdns-recursor","fixed_in":["4.1.16-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"pdns-recursor","fixed_in":["4.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pdns-recursor","fixed_in":["4.3.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"pdns-recursor","fixed_in":["4.1.16-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pdns-recursor","fixed_in":["4.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pdns-recursor","fixed_in":["4.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pdns-recursor","fixed_in":["4.3.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.11-1+deb10u1"}]}],"versions":["4.1.11-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-1","4.0.0~alpha1-1","4.0.0~alpha1-2","4.0.0~alpha2-2","4.0.0~alpha2-2ubuntu0.1","4.0.0~alpha2-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.6-1","4.0.6-1build1","4.0.7-1","4.1.1-1","4.1.1-1build1","4.1.1-2","4.1.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-6","4.2.1-1","4.2.1-1build1","4.2.1-1build2","4.2.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP1","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.12-bp151.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.12-bp151.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.12-bp151.4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pdns-recursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1.3"}]}],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"powerdns","product":"recursor"}],"references":[{"url":"http://www.nxnsattack.com","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory"]},{"url":"https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4691","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00052.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10995"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMP72NJGKBWR5WEBXAWX5KSLQUDFTG6S/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PS4ZN5XGENYNFKX7QIIOUCQQHXE37GJF/"},{"url":"https://github.com/advisories/GHSA-g5gv-j2x8-cxr2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-10995","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-10995","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0223.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26645","tags":["report"]},{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html","tags":["advisory"]},{"url":"https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-02.html","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2020/05/19/3","tags":["web","report"]},{"url":"https://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-10995","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10995","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LEZPG4GM5KFH6L7EPATOSNLDHKRJP667/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171553","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12244","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25829","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-10995","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2020-05-19T16:04:12Z","modified":"2024-08-04T11:21:14.519Z","updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-3392","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2020-05-19T16:04:12Z","modified":"2024-08-04T11:21:14Z","updated_at":"2026-11-03T03:07:48.03567Z"}],"ghsa":[{"id":"GHSA-g5gv-j2x8-cxr2","title":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against...","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2022-05-24T17:18:06Z","modified":"2023-01-29T05:02:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T14:45:09.006349Z"}],"nvd":[{"id":"CVE-2020-10995","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2020-05-19T17:15:10.163Z","modified":"2026-06-17T02:48:49.6Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"ALPINE-CVE-2020-10995","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2020-05-19T17:15:10.163Z","modified":"2026-11-03T06:32:23.209427298Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-10995","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2020-05-19T17:15:10.163Z","modified":"2026-10-24T10:30:43.679195226Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2020-10995","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2020-05-19T17:15:10.163Z","modified":"2026-10-26T12:01:16.70438861Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-10995","description":"PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.","status":"published","published":"2020-05-19T12:00:00Z","modified":"2025-09-08T16:46:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DSA-4691-1","title":"pdns-recursor - security update","status":"published","published":"2020-05-21T00:00:00Z","modified":"2026-03-09T02:09:27.962792Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0223","title":"Updated pdns-recursor packages fix security vulnerabilities","description":"Updated pdns-recursor packages fix security vulnerabilities:\n\nAn issue in the DNS protocol has been found that allow malicious parties\nto use recursive DNS services to attack third party authoritative name\nservers. The attack uses a crafted reply by an authoritative name server\nto amplify the resulting traffic between the recursive and other\nauthoritative name servers. Both types of service can suffer degraded\nperformance as an effect (CVE-2020-10995).\n\nAn issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where\nrecords in the answer section of a NXDOMAIN response lacking an SOA were\nnot properly validated in SyncRes::processAnswer. This would allow an\nattacker in position of man-in-the-middle to send a NXDOMAIN answer for\na name that does exist, bypassing DNSSEC validation (CVE-2020-12244).\n","status":"published","published":"2020-05-24T18:04:47Z","modified":"2026-04-16T04:44:48.011878964Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0698-1","title":"Security update for pdns-recursor","description":"This update for pdns-recursor fixes the following issues:\n\n- update to 4.1.16\n  * fixes an issue where records in the answer section of\n    a NXDOMAIN response lacking an SOA were not properly validated\n    (CVE-2020-12244, boo#1171553)\n  * fixes an issue where invalid hostname on the server can result in\n    disclosure of invalid memory (CVE-2020-10030, boo#1171553)\n  * fixes an issue in the DNS protocol has been found that allows\n    malicious parties to use recursive DNS services to attack third\n    party authoritative name servers (CVE-2020-10995, boo#1171553)\n\nFor details see\nhttps://doc.powerdns.com/recursor/changelog/4.1.html#change-4.1.16\n\n","status":"published","published":"2020-05-23T07:22:00Z","modified":"2026-02-04T02:48:32.953843Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11157-1","title":"pdns-recursor-4.5.5-1.3 on GA media","description":"These are all security issues fixed in the pdns-recursor-4.5.5-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:58.848357Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}