{"cve_id":"CVE-2023-50387","published":"2024-02-14T16:15:45.300000+00:00","last_modified":"2026-06-17T06:39:35.510000+00:00","vuln_status":"Modified","description":"Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","base_score":7.5,"base_severity":"HIGH","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"NONE","impact_i":"NONE","impact_a":"HIGH","cwe_ids":["CWE-770"],"in_kev":false,"kev_date_added":null,"kev_ransomware":false,"epss_score":0.9999,"epss_percentile":0.99984,"cap_rule_version":"0.1.1","stage":"IMPACT","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"NONE","caps":["DOS"],"terminal":true,"cap_confidence":"high","ingested_at":"2026-09-18T10:53:31.359724+00:00","first_seen":"2024-02-14T16:15:45.300000+00:00","kev_first_seen":null,"novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["fedoraproject","isc","microsoft","nic","nlnetlabs","powerdns","redhat","thekelleys"],"products":["bind","dnsmasq","enterprise_linux","fedora","knot_resolver","recursor","unbound","windows_server_2008","windows_server_2012","windows_server_2016","windows_server_2019","windows_server_2022","windows_server_2022_23h2"],"affected":[{"vendor":"fedoraproject","product":"fedora","ranges":["39"]},{"vendor":"isc","product":"bind","ranges":["≥ 9.19.0 and ≤ 9.19.20","≥ 9.18.0 and ≤ 9.18.22","≥ 9.0.0 and ≤ 9.16.46"]},{"vendor":"microsoft","product":"windows_server_2008","ranges":["r2"]},{"vendor":"microsoft","product":"windows_server_2012","ranges":["r2","all versions"]},{"vendor":"microsoft","product":"windows_server_2016","ranges":["all versions"]},{"vendor":"microsoft","product":"windows_server_2019","ranges":["all versions"]},{"vendor":"microsoft","product":"windows_server_2022","ranges":["all versions"]},{"vendor":"microsoft","product":"windows_server_2022_23h2","ranges":["all versions"]},{"vendor":"nic","product":"knot_resolver","ranges":["< 5.71"]},{"vendor":"nlnetlabs","product":"unbound","ranges":["< 1.19.1"]},{"vendor":"powerdns","product":"recursor","ranges":["≥ 4.8.0 and < 4.8.6","≥ 4.9.0 and < 4.9.3","≥ 5.0.0 and < 5.0.2"]},{"vendor":"redhat","product":"enterprise_linux","ranges":["7.0","6.0","9.0","8.0"]},{"vendor":"thekelleys","product":"dnsmasq","ranges":["< 2.90"]}]}