01 Record

CVE-2023-50387

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka

HighPUBLISHEDCNA: mitre

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

100.00% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 100.0% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-02-14 00:00Z2 YR AGO

Last updated

2025-11-04 18:20Z10 MO AGO

Reserved

2023-12-07

Assigning CNA

mitre

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-770Allocation of Resources Without Limits or ThrottlingBase
CWE-400Uncontrolled Resource ConsumptionClass

Data version

5.2

Document digest

b7d66875229d1d97da438ed366552657d1b2d6c891b9335805afbe93a87be63b

05 Affected products

VendorProductVersionsPlatforms

fedoraprojectfedoraNot specified—

iscbindNot specified—

microsoftwindows_server_2008Not specified—

microsoftwindows_server_2012Not specified—

microsoftwindows_server_2016Not specified—

microsoftwindows_server_2019Not specified—

microsoftwindows_server_2022Not specified—

microsoftwindows_server_2022_23h2Not specified—

nicknot_resolverNot specified—

nlnetlabsunboundNot specified—

powerdnsrecursorNot specified—

redhatenterprise_linuxNot specified—

redhatrhel_ausNot specified—

redhatrhel_e4sNot specified—

redhatrhel_elsNot specified—

redhatrhel_eusNot specified—

redhatrhel_tusNot specified—

thekelleysdnsmasqNot specified—

06 References

www.athene-center.dehttps://www.athene-center.de/aktuelles/key-trap
nlnetlabs.nlhttps://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
kb.isc.orghttps://kb.isc.org/docs/cve-2023-50387
docs.powerdns.comhttps://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
www.theregister.comhttps://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
news.ycombinator.comhttps://news.ycombinator.com/item?id=39367411
www.securityweek.comhttps://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/
www.isc.orghttps://www.isc.org/blogs/2024-bind-security-release/
news.ycombinator.comhttps://news.ycombinator.com/item?id=39372384
gitlab.nic.czhttps://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
lists.thekelleys.org.ukhttps://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html
msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387
access.redhat.comhttps://access.redhat.com/security/cve/CVE-2023-50387
bugzilla.suse.comhttps://bugzilla.suse.com/show_bug.cgi?id=1219823
www.athene-center.dehttps://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf
www.openwall.com[oss-security] 20240216 Re: Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilitieshttp://www.openwall.com/lists/oss-security/2024/02/16/2mailing-list
www.openwall.com[oss-security] 20240216 Re: Unbound: disclosure of CVE-2023-50387 and CVE-2023-50868 DNSSEC validation vulnerabilitieshttp://www.openwall.com/lists/oss-security/2024/02/16/3mailing-list
lists.fedoraproject.orgFEDORA-2024-2e26eccfcbhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-e24211eff0https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-21310568fahttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/vendor-advisory
lists.debian.org[debian-lts-announce] 20240221 [SECURITY] [DLA 3736-1] unbound security updatehttps://lists.debian.org/debian-lts-announce/2024/02/msg00006.htmlmailing-list
lists.fedoraproject.orgFEDORA-2024-b0f9656a76https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-4e36df9dfdhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-499b9be35fhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-c36c448396https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-c967c7d287https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-e00eceb11chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/vendor-advisory
lists.fedoraproject.orgFEDORA-2024-fae88b73ebhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/vendor-advisory
security.netapp.comhttps://security.netapp.com/advisory/ntap-20240307-0007/
lists.debian.org[debian-lts-announce] 20240517 [SECURITY] [DLA 3816-1] bind9 security updatehttps://lists.debian.org/debian-lts-announce/2024/05/msg00011.htmlmailing-list
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/11/msg00035.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/09/msg00001.html
lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/

01 Record index

CVE-2023-50387

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2023-50387

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References