CVE-2020-12244: Debian Linux

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• Powerdns Recursor: from 4.1.0, up to and including 4.3.0

Published 2020-05-19. Last modified 2026-06-17.