CVE-2020-8616

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

• CWE-400

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
• http://www.nxnsattack.comExploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/05/19/4Mailing List, Patch, Third Party Advisory
• https://kb.isc.org/docs/cve-2020-8616Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/
• https://security.netapp.com/advisory/ntap-20200522-0002/
• https://usn.ubuntu.com/4365-1/
• https://usn.ubuntu.com/4365-2/
• https://www.debian.org/security/2020/dsa-4689Third Party Advisory
• https://www.synology.com/security/advisory/Synology_SA_20_12
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
• http://www.nxnsattack.comExploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/05/19/4Mailing List, Patch, Third Party Advisory
• https://kb.isc.org/docs/cve-2020-8616Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/
• https://security.netapp.com/advisory/ntap-20200522-0002/
• https://usn.ubuntu.com/4365-1/
• https://usn.ubuntu.com/4365-2/
• https://www.debian.org/security/2020/dsa-4689Third Party Advisory
• https://www.synology.com/security/advisory/Synology_SA_20_12

Published

May 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8607An input validation vulnerability found in multiple Trend Mi…6.7
• CVE-2020-8608In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses…5.6
• CVE-2020-8611In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.…8.8
• CVE-2020-8612In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.…9
• CVE-2020-8614An issue was discovered on Askey AP4000W TDC_V1.01.003 devic…9.8
• CVE-2020-8615A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 fo…6.5
• CVE-2020-8617Using a specially-crafted message, an attacker may potential…5.9
• CVE-2020-8618An attacker who is permitted to send zone data to a server v…4.9
• CVE-2020-8619In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -…4.9
• CVE-2020-8620In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who …7.5
• CVE-2020-8621In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is c…7.5
• CVE-2020-8622In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3…6.5