{"id":"CVE-2020-19860","details":"When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload.","modified":"2026-05-18T19:08:17.018184Z","published":"2022-01-21T14:15:07.690Z","related":["SUSE-SU-2022:0675-1","openSUSE-SU-2022:0675-1","openSUSE-SU-2024:11802-1"],"references":[{"type":"REPORT","url":"https://github.com/NLnetLabs/ldns/issues/50"},{"type":"FIX","url":"https://github.com/NLnetLabs/ldns/commit/15d96206996bea969fbc918eb0a4a346f514b9f3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nlnetlabs/ldns","events":[{"introduced":"0"},{"last_affected":"53bc57512c19b11eebc403a4cb2bbf7295eb0db1"}],"database_specific":{"cpe":"cpe:2.3:a:nlnetlabs:ldns:1.7.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.7.1"}],"source":"CPE_FIELD"}}],"versions":["release-1.7.1","release-1.7.1-rc1","release-1.7.0-rc1","release-1.6.17rc1","release-1.6.11"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-19860.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}]}