Vulnerability Intelligence Report
CVE-2023-50387
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
EPSS Probability:100.00%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-770 ↗CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| redhat | enterprise_linux | 6.0, 7.0, 8.0, 9.0 |
| microsoft | windows_server_2008 | r2 |
| microsoft | windows_server_2012 | r2 |
| microsoft | windows_server_2016 | all |
| microsoft | windows_server_2019 | all |
| microsoft | windows_server_2022 | all |
| microsoft | windows_server_2022_23h2 | all |
| fedoraproject | fedora | 39 |
| thekelleys | dnsmasq | all |
| nic | knot_resolver | all |
| powerdns | recursor | all |
| isc | bind | all |
| nlnetlabs | unbound | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
99.995%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2023-12-07T00:00:00 |
| Published | 2024-02-14T00:00:00 |
| Last Updated | 2025-11-04T18:20:34 |
Community Chatter & Buzz