What’s Vulnerable › Vulnerabilities

CVE-2023-50387

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-14 · updated 2026-06-17
• Weakness: CWE-770

Description

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Affected products

• Fedoraproject Fedora: 39
• ISC BIND: from 9.0.0 through 9.16.46; from 9.18.0 through 9.18.22; from 9.19.0 through 9.19.20
• Microsoft Windows Server 2008: r2-sp1
• Microsoft Windows Server 2012: r2
• Microsoft Windows Server 2016: all versions
• Microsoft Windows Server 2019: all versions
• Microsoft Windows Server 2022: all versions
• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation): all versions
• CZ.NIC knot-resolver: before 5.71 — fixed in 5.71
• NLnet Labs Unbound: before 1.19.1 — fixed in 1.19.1
• PowerDNS Recursor: from 4.8.0 before 4.8.6; from 4.9.0 before 4.9.3; from 5.0.0 before 5.0.2 — fixed in 4.8.6, 4.9.3, 5.0.2
• Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0
• Simon Kelley dnsmasq: before 2.90 — fixed in 2.90

How to fix

Upgrade to a fixed version: CZ.NIC knot-resolver 5.71; NLnet Labs Unbound 1.19.1; PowerDNS Recursor 4.8.6, 4.9.3, 5.0.2; Simon Kelley dnsmasq 2.90. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/02/16/2
• http://www.openwall.com/lists/oss-security/2024/02/16/3
• https://access.redhat.com/security/cve/CVE-2023-50387
• https://bugzilla.suse.com/show_bug.cgi?id=1219823
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
• https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
• https://kb.isc.org/docs/cve-2023-50387
• https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
• https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/

Get alerted when CVE-2023-50387 or the next vulnerability affects your stack