CVE-2020-25686

Name: CVE-2020-25686
Creator: NVD / NIST
Published: 2021-01-20T17:15:13+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 3.7/10EPSS 4.91%

Last modified Jun 17, 2026

CVE-2020-25686 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. EPSS estimates a 4.91% chance of exploitation in the next 30 days.

Description

A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that it would have to perform to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. The highest threat from this vulnerability is to data integrity.

Metrics

CVSS 3.1

3.7/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Probability

4.91%

91.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Thekelleys	Dnsmasq	< 2.83
Fedoraproject	Fedora	32
Fedoraproject	Fedora	33
Debian	Debian Linux	10.0
Arista	Eos	>= 4.21, < 4.21.14m
Arista	Eos	>= 4.22, < 4.22.9m
Arista	Eos	>= 4.23, < 4.23.7m
Arista	Eos	>= 4.24, < 4.24.5m
Arista	Eos	>= 4.25, < 4.25.2f

References

https://bugzilla.redhat.com/show_bug.cgi?id=1890125Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/
https://security.gentoo.org/glsa/202101-17Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/12135-security-advisory-61Third Party Advisory
https://www.debian.org/security/2021/dsa-4844Third Party Advisory
https://www.jsof-tech.com/disclosures/dnspooq/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1890125Issue Tracking, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGB7HL3OWHTLEPSMLDGOMXQKG3KM2QME/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYW3IR6APUSKOYKL5FT3ACTIHWHGQY32/
https://security.gentoo.org/glsa/202101-17Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/12135-security-advisory-61Third Party Advisory
https://www.debian.org/security/2021/dsa-4844Third Party Advisory
https://www.jsof-tech.com/disclosures/dnspooq/Third Party Advisory
https://www.kb.cert.org/vuls/id/434904

Timeline

Published: Jan 20, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-25686?

How severe is CVE-2020-25686?

CVE-2020-25686 has a CVSS score of 3.7/10 (LOW severity). The EPSS model estimates a 4.91% probability of exploitation in the next 30 days.

How do I fix CVE-2020-25686?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-25686?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST