CVE-2020-8619

Low

No strong exploitation signal.

CVSS base

4.9 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

EPSS — probability of exploitation (30 days)

2.1%

80.9th percentile

CISA KEV

Not listed

Weakness / dates

CWE-404

Published 2020-06-17 · modified 2026-09-01

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	H	High
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	N	None
Integrity	N	None
Availability	H	High

Timeline

2020-06-17 — Published (NVD)
2026-09-01 — Last modified (NVD)

Description

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

Affected

canonical debian fedoraproject isc netapp opensuse

References

Official: NVD · CVE.org