Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2020-5232: ENS domain service can be hijacked and reclaimed
CVE-2020-5232 · published 6 years ago
Summary
If you own an ENS name, an attacker can set a hidden trick that lets them transfer the name to someone else and later take it back without the new owner's permission. This could cause loss of control over your web address or crypto wallet links. Switch to the newly released ENS deployment that removes this hidden trick as soon as possible.
What to do
- Update ensdomains ens to version 0.4.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | ensdomains | ens |
< 0.4.0 Fix: upgrade to 0.4.0
|
| – | ens.domains | ethereum_name_service |
<= 0.1.0 cpe:2.3:a:ens.domains:ethereum_name_service:*:*:*:*:*:*:*:* |
Original advisory text
Malicious takeover of previously owned ENS names
A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consent or awareness. A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-5232
- https://github.com/advisories/GHSA-8f9f-pc5v-9r5h
- https://github.com/ensdomains/ens/commit/36e10e71fcddcade88646821e0a57cc6c19e1ec... Patch Third Party Advisory
- https://github.com/ensdomains/ens/security/advisories/GHSA-8f9f-pc5v-9r5h Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-285Improper Authorization
Timeline
Published31 Jan 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta