{"id":"CVE-2020-19861","aliases":["DEBIAN-CVE-2020-19861","DLA-2910-1","EUVD-2020-11757","GHSA-fhv5-v23r-vj74","SUSE-SU-2022:0675-1","UBUNTU-CVE-2020-19861","USN-5257-1","USN-5257-2","openSUSE-SU-2022:0675-1","openSUSE-SU-2024:11802-1"],"status":"published","title":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for...","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01493,"percentile":0.74328,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-125"],"published":"2022-01-21T14:22:16Z","modified":"2026-10-26T12:00:48Z","fixes":[{"ecosystem":"Debian:12","package":"ldns","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ldns","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ldns","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ldns","fixed_in":["1.6.17-8ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ldns","fixed_in":["1.7.0-3ubuntu4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ldns","fixed_in":["1.7.0-4.1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ldns","fixed_in":["1.7.1-2ubuntu4+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1+deb9u1"}]}],"versions":["1.7.0-1"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-8ubuntu0.1+esm1"}]}],"versions":["1.6.17-5","1.6.17-7","1.6.17-8","1.6.17-8ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu4.1"}]}],"versions":["1.7.0-1ubuntu1","1.7.0-3ubuntu1","1.7.0-3ubuntu2","1.7.0-3ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.1ubuntu1+esm1"}]}],"versions":["1.7.0-3ubuntu8","1.7.0-4","1.7.0-4ubuntu1","1.7.0-4.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2ubuntu4+esm1"}]}],"versions":["1.7.1-2build1","1.7.1-2ubuntu1","1.7.1-2ubuntu3","1.7.1-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-8ubuntu0.1+esm1"}]}],"versions":["1.6.17-5","1.6.17-7","1.6.17-8","1.6.17-8ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-3ubuntu4.1"}]}],"versions":["1.7.0-1ubuntu1","1.7.0-3ubuntu1","1.7.0-3ubuntu2","1.7.0-3ubuntu4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.1ubuntu1+esm1"}]}],"versions":["1.7.0-3ubuntu8","1.7.0-4","1.7.0-4ubuntu1","1.7.0-4.1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-2ubuntu4+esm1"}]}],"versions":["1.7.1-2build1","1.7.1-2ubuntu1","1.7.1-2ubuntu3","1.7.1-2ubuntu4"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"nlnetlabs","product":"ldns"}],"references":[{"url":"https://github.com/NLnetLabs/ldns/issues/51","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://cwe.mitre.org/data/definitions/126.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-19861"},{"url":"https://github.com/advisories/GHSA-fhv5-v23r-vj74"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-19861","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220675-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195057","tags":["report"]},{"url":"https://bugzilla.suse.com/1195058","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-19860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-19861","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-19861","tags":["report"]},{"url":"https://github.com/NLnetLabs/ldns/commit/136ec420437041fe13f344a2053e774f9050cc38","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5257-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5257-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-19861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-19860","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4UGIOR5OPYQTAQRTVNXBBH25LGJ74XJJ/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-19861","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","status":"published","published":"2022-01-21T14:22:16Z","modified":"2024-08-04T14:15:28.49Z","updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-11757","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","status":"published","published":"2022-01-21T14:22:16Z","modified":"2024-08-04T14:15:28Z","updated_at":"2026-11-03T03:07:24.770982Z"}],"ghsa":[{"id":"GHSA-fhv5-v23r-vj74","title":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for...","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","status":"published","published":"2022-01-22T00:00:44Z","modified":"2023-01-27T05:05:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-120","CWE-125"],"updated_at":"2026-11-02T14:42:41.939038Z"}],"nvd":[{"id":"CVE-2020-19861","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","status":"published","published":"2022-01-21T15:15:07.607Z","modified":"2026-06-17T02:59:59.303Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:46.951463Z"}],"osv":[{"id":"CVE-2020-19861","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","status":"published","published":"2022-01-21T15:15:07.607Z","modified":"2026-10-20T10:52:07.557176338Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"DEBIAN-CVE-2020-19861","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","status":"published","published":"2022-01-21T15:15:07.607Z","modified":"2026-10-26T12:00:48.343595163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-19861","description":"When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.","status":"published","published":"2022-01-21T15:15:00Z","modified":"2026-04-22T12:33:54.957085Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-2910-1","title":"ldns - security update","status":"published","published":"2022-02-03T00:00:00Z","modified":"2026-03-09T01:22:44.312766Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"openSUSE-SU-2022:0675-1","title":"Security update for ldns","description":"This update for ldns fixes the following issues:\n\n- CVE-2020-19860: Fixed heap-based out of bounds read when verifying a zone file (bsc#1195057).\n- CVE-2020-19861: Fixed heap-based out of bounds read in ldns_nsec3_salt_data() (bsc#1195058).\n","status":"published","published":"2022-03-02T17:50:57Z","modified":"2026-02-04T03:58:35.866999Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11802-1","title":"ldns-1.8.1-1.1 on GA media","description":"These are all security issues fixed in the ldns-1.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:45.127531Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2022:0675-1","title":"Security update for ldns","description":"This update for ldns fixes the following issues:\n\n- CVE-2020-19860: Fixed heap-based out of bounds read when verifying a zone file (bsc#1195057).\n- CVE-2020-19861: Fixed heap-based out of bounds read in ldns_nsec3_salt_data() (bsc#1195058).\n","status":"published","published":"2022-03-02T17:50:40Z","modified":"2026-02-04T02:25:00.827408Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-5257-1","title":"ldns vulnerabilities","description":"It was discovered that ldns incorrectly handled certain inputs.\nAn attacker could possibly use this issue to expose sensitive information.\n(CVE-2020-19860, CVE-2020-19861)\n","status":"published","published":"2022-01-31T12:40:54Z","modified":"2026-06-25T13:30:59.917895251Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5257-2","title":"ldns vulnerabilities","description":"USN-5257-1 fixed several vulnerabilities in ldns. This update provides\nthe corresponding update for Ubuntu 20.04 ESM and Ubuntu 22.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that ldns incorrectly handled certain inputs.\n An attacker could possibly use this issue to expose sensitive information.\n (CVE-2020-19860, CVE-2020-19861)\n","status":"published","published":"2022-10-04T22:57:36Z","modified":"2026-04-27T14:58:05.120065Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}