What is CVE-2020-12662?

CVE-2020-12662 is a high-severity vulnerability in Nlnetlabs Unbound, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-05-19.

How severe is CVE-2020-12662?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Nlnetlabs Unbound

CVE-2020-12662

Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

Vulnerability class: DoS (Denial of Service)

Published 2020-05-19 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.032 (87.6th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 87.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.032 · newest: 0.032 · change: +0.000

Affected products

Nlnetlabs Unbound
Canonical Ubuntu Linux — versions 18.04, 19.10, 20.04
Debian Linux — versions 9.0, 10.0
Fedoraproject Fedora — versions 31, 32
openSUSE Leap — versions 15.1, 15.2

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

nlnetlabs.nl/downloads/unbound/CVE-2020-12662_2020-12663.txt (Vendor Advisory)
www.nxnsattack.com (Technical Description)
www.openwall.com/lists/oss-security/2020/05/19/5 (mailing-list, Patch, Mailing List, Third Party Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
www.debian.org/security/2020/dsa-4694 (vendor-advisory, Third Party Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
www.synology.com/security/advisory/Synology_SA_20_12 (Third Party Advisory)
usn.ubuntu.com/4374-1/ (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html (vendor-advisory, Mailing List, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html (vendor-advisory, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2020-12662?: CVE-2020-12662 is a high-severity vulnerability in Nlnetlabs Unbound, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-05-19.
How severe is CVE-2020-12662?: High severity. CVSS v3 base score is 7.5 out of 10.