What’s Vulnerable › Vulnerabilities

CVE-2020-8621: Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-21 · updated 2026-06-17
• Weakness: CWE-617

Description

In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 20.04
• ISC BIND: from 9.14.0 through 9.16.5; from 9.17.0 through 9.17.3
• NetApp Steelstore Cloud Integrated Storage: all versions
• openSUSE Leap: 15.1, 15.2
• Synology DNS Server: before 2.2.2-5027 — fixed in 2.2.2-5027

How to fix

Upgrade to a fixed version: Synology DNS Server 2.2.2-5027. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
• https://kb.isc.org/docs/cve-2020-8621
• https://security.gentoo.org/glsa/202008-19
• https://security.netapp.com/advisory/ntap-20200827-0003/
• https://usn.ubuntu.com/4468-1/
• https://www.synology.com/security/advisory/Synology_SA_20_19
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
• https://kb.isc.org/docs/cve-2020-8621
• https://security.gentoo.org/glsa/202008-19
• https://security.netapp.com/advisory/ntap-20200827-0003/

Get alerted when CVE-2020-8621 or the next vulnerability affects your stack