CVE-2023-50387 in the critical feed json
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of se…
published 2024-02-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-55182
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 100.0%
- EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 0
- none known
Summary
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
Patch / fix
- thekelleys dnsmasq 2.90
- nic knot_resolver 5.71
- powerdns recursor 4.8.6, 4.9.3, 5.0.2
- nlnetlabs unbound 1.19.1
- bind9 Debian 12 1:9.18.24-1
- bind9 Debian 14, Debian 13 1:9.19.21-1
- dnsjava Debian 14, Debian 13 3.6.2-1
- dnsmasq Debian 12 2.90-4~deb12u1
- dnsmasq Debian 14, Debian 13 2.90-1
- systemd Debian 12 252.23-1~deb12u1
- systemd Debian 14, Debian 13 255.4-1
- unbound Debian 12 1.17.1-2+deb12u2
debian advisories DEBIAN-CVE-2023-50387
- bind9 Ubuntu 20.04 LTS 1:9.16.48-0ubuntu0.20.04.1
- bind9 Ubuntu 22.04 LTS 1:9.18.18-0ubuntu0.22.04.2
- dnsmasq Ubuntu 20.04 LTS 2.90-0ubuntu0.20.04.1
- dnsmasq Ubuntu 22.04 LTS 2.90-0ubuntu0.22.04.1
- unbound Ubuntu 20.04 LTS 1.9.4-2ubuntu1.5
- unbound Ubuntu 22.04 LTS 1.13.1-1ubuntu5.4
- unbound Ubuntu 24.04 LTS 1.19.1-1ubuntu1
- bind9 Ubuntu Pro 14.04 LTS 1:9.9.5.dfsg-3ubuntu0.19+esm12
ubuntu advisories UBUNTU-CVE-2023-50387
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- bind RHEL 9 32:9.16.23-18.el9_4.1
- bind-libs RHEL 9 32:9.16.23-18.el9_4.1
- bind-utils RHEL 9 32:9.16.23-18.el9_4.1
- bind-chroot RHEL 9 32:9.16.23-18.el9_4.1
- bind-license RHEL 9 32:9.16.23-18.el9_4.1
- python3-bind RHEL 9 32:9.16.23-18.el9_4.1
- bind-dyndb-ldap RHEL 9 11.9-9.el9_4
- bind-dnssec-utils RHEL 9 32:9.16.23-18.el9_4.1
red hat advisories RHSA-2025:0039RHSA-2024:11003RHSA-2024:2696RHSA-2024:2587RHSA-2024:1801RHSA-2024:1804
- dnsmasq Linux Micro 6.0 2.90-1.1
- unbound Linux Micro 6.0 1.21.0-1.1
- dnsmasq SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 2.90-150100.7.28.1
- dnsmasq SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +13 more 2.90-150400.16.3.1
- bind SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 9.16.6-150000.12.74.2
- libuv SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 1.18.0-150000.3.2.1
- unbound SLE Module for Package Hub 15 SP5, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +14 more 1.20.0-150100.10.13.1
- bind SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Module for Basesystem 15 SP6 +2 more 9.16.6-150300.22.44.1
suse advisories SUSE-SU-2025:20118-1SUSE-SU-2025:20024-1SUSE-SU-2025:0130-1SUSE-SU-2025:0071-1SUSE-SU-2024:2033-1SUSE-SU-2024:1991-2
- pdns-recursor openSUSE Tumbleweed 5.0.2-1.1
- bind openSUSE Tumbleweed 9.18.24-1.1
- dnsmasq openSUSE Tumbleweed 2.90-1.1
- unbound openSUSE Tumbleweed 1.19.1-1.1
- pdns-recursor Package Hub 15 SP5, openSUSE Leap 15.5 4.8.6-bp155.2.3.1
opensuse advisories openSUSE-SU-2024:13680-1openSUSE-SU-2024:13687-1openSUSE-SU-2024:13707-1openSUSE-SU-2024:13742-1openSUSE-SU-2024:0048-1
- bind AlmaLinux 8 32:9.11.36-14.el8_10
- bind-sdb AlmaLinux 8 32:9.11.36-14.el8_10
- bind-libs AlmaLinux 8 32:9.11.36-14.el8_10
- bind-utils AlmaLinux 8 32:9.11.36-14.el8_10
- bind-chroot AlmaLinux 8 32:9.11.36-14.el8_10
- bind-pkcs11 AlmaLinux 8 32:9.11.36-14.el8_10
- bind-license AlmaLinux 8 32:9.11.36-14.el8_10
- python3-bind AlmaLinux 8 32:9.11.36-14.el8_10
almalinux advisories ALSA-2024:3271ALSA-2024:2551ALSA-2024:1782ALSA-2024:1781ALSA-2024:1789ALSA-2024:1334
- bind Rocky Linux 8 2:9.11.36-14.el8_10
- dhcp Rocky Linux 8 2:4.3.6-50.el8_10
- bind Rocky Linux 9 2:9.16.23-18.el9_4.1
- bind-dyndb-ldap Rocky Linux 9 11.9-9.el9_4
- bind9.16 Rocky Linux 8 2:9.16.23-0.16.el8_9.2
- bind Rocky Linux 8 2:9.11.36-11.el8_9.1
- dhcp Rocky Linux 8 2:4.3.6-49.el8_9.1
- dnsmasq Rocky Linux 8 2.79-31.el8_9.2
rocky linux advisories RLSA-2024:3271RLSA-2024:2551RLSA-2024:1781RLSA-2024:1782RLSA-2024:1335
- bind Alpine 3.16 9.16.48-r0
- bind Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 9.18.24-r0
- dnsmasq Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 2.90-r0
- unbound Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 1.19.1-r0
- knot-resolver Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 5.7.1-r0
- knot-resolver Alpine 3.24 5.7.7-r0
- pdns-recursor Alpine 3.19, Alpine 3.18 4.9.3-r0
- pdns-recursor Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 5.0.2-r0
alpine advisories ALPINE-CVE-2023-50387
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- bind CBL-Mariner 2.0 9.16.48-1
- dnsmasq CBL-Mariner 2.0 2.90-1
- unbound CBL-Mariner 2.0, Azure Linux 3.0 1.19.1-1
- bind Azure Linux 3.0 9.20.0-1
azure linux advisories AZL-34350AZL-34419AZL-34440AZL-34559AZL-35328
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-50387 updated cvss 7.5
bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator
-
Red Hat CodeReady Linux Builder (v. 8) bind9.16 9.16.23-0.16.el8_9.2, bind9.16-libs 9.16.23-0.16.el8_9.2, bind9.16-utils 9.16.23-0.16.el8_9.2, bind9.16-chroot 9.16.23-0.16.el8_9.2, bind9.16-license 9.16.23-0.16.el8_9.2, python3-bind9.16 9.16.23-0.16.el8_9.2, +1 morefixed: vendor fix RHSA-2024:1781
-
Red Hat CodeReady Linux Builder (v. 9) bind 9.16.23-14.el9_3.4, unbound 1.16.2-3.el9_3.1, bind-libs 9.16.23-14.el9_3.4, bind-utils 9.16.23-14.el9_3.4, unbound-libs 1.16.2-3.el9_3.1, bind-chroot 9.16.23-14.el9_3.4, +4 morefixed: vendor fix RHSA-2024:1789
-
Red Hat CodeReady Linux Builder EUS (v.8.6) bind9.16 9.16.23-0.7.el8_6.5, bind9.16-libs 9.16.23-0.7.el8_6.5, bind9.16-utils 9.16.23-0.7.el8_6.5, bind9.16-chroot 9.16.23-0.7.el8_6.5, bind9.16-license 9.16.23-0.7.el8_6.5, python3-bind9.16 9.16.23-0.7.el8_6.5, +1 morefixed: vendor fix RHSA-2024:1647
-
Red Hat CodeReady Linux Builder EUS (v.8.8) bind9.16 9.16.23-0.14.el8_8.4, bind9.16-libs 9.16.23-0.14.el8_8.4, bind9.16-utils 9.16.23-0.14.el8_8.4, bind9.16-chroot 9.16.23-0.14.el8_8.4, bind9.16-license 9.16.23-0.14.el8_8.4, python3-bind9.16 9.16.23-0.14.el8_8.4, +1 morefixed: vendor fix RHSA-2024:1648
-
Red Hat CodeReady Linux Builder EUS (v.9.0) bind 9.16.23-1.el9_0.5, bind-libs 9.16.23-1.el9_0.5, bind-utils 9.16.23-1.el9_0.5, bind-chroot 9.16.23-1.el9_0.5, bind-license 9.16.23-1.el9_0.5, python3-bind 9.16.23-1.el9_0.5, +1 morefixed: vendor fix RHSA-2024:1800
-
Red Hat CodeReady Linux Builder EUS (v.9.2) bind 9.16.23-11.el9_2.4, unbound 1.16.2-3.el9_2.1, bind-libs 9.16.23-11.el9_2.4, bind-utils 9.16.23-11.el9_2.4, unbound-libs 1.16.2-3.el9_2.1, bind-chroot 9.16.23-11.el9_2.4, +4 morefixed: vendor fix RHSA-2024:1803
-
Red Hat Enterprise Linux AppStream (v. 8) bind 9.11.36-14.el8_10, bind 9.11.36-11.el8_9.1, dnsmasq 2.79-31.el8_9.2, unbound 1.16.2-5.el8_9.2, bind-sdb 9.11.36-14.el8_10, bind-libs 9.11.36-14.el8_10, +32 morefixed: vendor fix RHSA-2024:3271
-
Red Hat Enterprise Linux AppStream (v. 9) bind 9.16.23-14.el9_3.4, bind 9.16.23-18.el9_4.1, dnsmasq 2.85-14.el9_3.1, unbound 1.16.2-3.el9_3.1, bind-dyndb-ldap 11.9-9.el9_4, bind-libs 9.16.23-14.el9_3.4, +15 morefixed: vendor fix RHSA-2024:1789
show 25 moreshow fewer
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) bind 9.11.13-6.el8_2.7, dnsmasq 2.79-11.el8_2.3, unbound 1.7.3-12.el8_2.1, bind-sdb 9.11.13-6.el8_2.7, bind-libs 9.11.13-6.el8_2.7, bind-utils 9.11.13-6.el8_2.7, +12 morefixed: vendor fix RHSA-2024:2890
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) bind 9.11.26-4.el8_4.4, dnsmasq 2.79-15.el8_4.2, unbound 1.7.3-15.el8_4.1, bind-sdb 9.11.26-4.el8_4.4, bind-libs 9.11.26-4.el8_4.4, bind-utils 9.11.26-4.el8_4.4, +12 morefixed: vendor fix RHSA-2024:2821
-
Red Hat Enterprise Linux AppStream E4S (v. 8.2) unbound 1.7.3-12.el8_2.1, unbound-libs 1.7.3-12.el8_2.1, python3-unbound 1.7.3-12.el8_2.1fixed: vendor fix RHSA-2024:2696
-
Red Hat Enterprise Linux AppStream E4S (v.8.4) bind 9.11.26-4.el8_4.4, dnsmasq 2.79-15.el8_4.2, unbound 1.7.3-15.el8_4.1, bind-sdb 9.11.26-4.el8_4.4, bind-libs 9.11.26-4.el8_4.4, bind-utils 9.11.26-4.el8_4.4, +12 morefixed: vendor fix RHSA-2024:2821
-
Red Hat Enterprise Linux AppStream EUS (v.8.6) bind 9.11.36-3.el8_6.7, dnsmasq 2.79-21.el8_6.5, unbound 1.7.3-17.el8_6.4, bind-sdb 9.11.36-3.el8_6.7, bind-libs 9.11.36-3.el8_6.7, bind-utils 9.11.36-3.el8_6.7, +19 morefixed: vendor fix RHSA-2024:2720
-
Red Hat Enterprise Linux AppStream EUS (v.8.8) bind 9.11.36-8.el8_8.4, dnsmasq 2.79-26.el8_8.4, unbound 1.16.2-5.el8_8.1, bind-sdb 9.11.36-8.el8_8.4, bind-libs 9.11.36-8.el8_8.4, bind-utils 9.11.36-8.el8_8.4, +19 morefixed: vendor fix RHSA-2024:2721
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) bind 9.16.23-1.el9_0.5, dnsmasq 2.85-3.el9_0.1, unbound 1.13.1-13.el9_0.4, bind-libs 9.16.23-1.el9_0.5, bind-utils 9.16.23-1.el9_0.5, dnsmasq-utils 2.85-3.el9_0.1, +7 morefixed: vendor fix RHSA-2024:1800
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) dnsmasq 2.85-6.el9_2.3, bind 9.16.23-11.el9_2.4, unbound 1.16.2-3.el9_2.1, bind-libs 9.16.23-11.el9_2.4, dnsmasq-utils 2.85-6.el9_2.3, bind-utils 9.16.23-11.el9_2.4, +7 morefixed: vendor fix RHSA-2024:1803
-
Red Hat Enterprise Linux AppStream TUS (v. 8.2) unbound 1.7.3-12.el8_2.1, unbound-libs 1.7.3-12.el8_2.1, python3-unbound 1.7.3-12.el8_2.1fixed: vendor fix RHSA-2024:2696
-
Red Hat Enterprise Linux AppStream TUS (v.8.4) bind 9.11.26-4.el8_4.4, dnsmasq 2.79-15.el8_4.2, unbound 1.7.3-15.el8_4.1, bind-sdb 9.11.26-4.el8_4.4, bind-libs 9.11.26-4.el8_4.4, bind-utils 9.11.26-4.el8_4.4, +12 morefixed: vendor fix RHSA-2024:2821
-
Red Hat Enterprise Linux BaseOS (v. 8) bind 9.11.36-14.el8_10, bind 9.11.36-11.el8_9.1, bind-sdb 9.11.36-14.el8_10, bind-libs 9.11.36-14.el8_10, bind-sdb 9.11.36-11.el8_9.1, bind-libs 9.11.36-11.el8_9.1, +20 morefixed: vendor fix RHSA-2024:3271
-
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) dhcp 4.3.6-40.el8_2.3, bind 9.11.13-6.el8_2.7, bind-sdb 9.11.13-6.el8_2.7, dhcp-libs 4.3.6-40.el8_2.3, bind-libs 9.11.13-6.el8_2.7, dhcp-relay 4.3.6-40.el8_2.3, +13 morefixed: vendor fix RHSA-2024:2890
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) dhcp 4.3.6-44.el8_4.3, bind 9.11.26-4.el8_4.4, bind-sdb 9.11.26-4.el8_4.4, dhcp-libs 4.3.6-44.el8_4.3, bind-libs 9.11.26-4.el8_4.4, dhcp-relay 4.3.6-44.el8_4.3, +13 more Red Hat Enterprise Linux BaseOS E4S (v.8.4) dhcp 4.3.6-44.el8_4.3, bind 9.11.26-4.el8_4.4, bind-sdb 9.11.26-4.el8_4.4, dhcp-libs 4.3.6-44.el8_4.3, bind-libs 9.11.26-4.el8_4.4, dhcp-relay 4.3.6-44.el8_4.3, +13 morefixed: vendor fix RHSA-2024:2821
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) dhcp 4.3.6-47.el8_6.2, bind 9.11.36-3.el8_6.7, bind-sdb 9.11.36-3.el8_6.7, dhcp-libs 4.3.6-47.el8_6.2, bind-libs 9.11.36-3.el8_6.7, dhcp-relay 4.3.6-47.el8_6.2, +13 morefixed: vendor fix RHSA-2024:2720
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) dhcp 4.3.6-49.el8_8.1, bind 9.11.36-8.el8_8.4, bind-sdb 9.11.36-8.el8_8.4, dhcp-libs 4.3.6-49.el8_8.1, bind-libs 9.11.36-8.el8_8.4, dhcp-relay 4.3.6-49.el8_8.1, +13 morefixed: vendor fix RHSA-2024:2721
-
Red Hat Enterprise Linux BaseOS TUS (v.8.4) dhcp 4.3.6-44.el8_4.3, bind 9.11.26-4.el8_4.4, bind-sdb 9.11.26-4.el8_4.4, dhcp-libs 4.3.6-44.el8_4.3, bind-libs 9.11.26-4.el8_4.4, dhcp-relay 4.3.6-44.el8_4.3, +13 morefixed: vendor fix RHSA-2024:2821
-
Red Hat Enterprise Linux Client (v. 7) dhcp 4.2.5-83.el7_9.2, dhclient 4.2.5-83.el7_9.2, bind 9.11.4-26.P2.el7_9.16, dhcp-libs 4.2.5-83.el7_9.2, dhcp-common 4.2.5-83.el7_9.2, bind-sdb 9.11.4-26.P2.el7_9.16, +10 more Red Hat Enterprise Linux Client Optional (v. 7) dhcp 4.2.5-83.el7_9.2, dhclient 4.2.5-83.el7_9.2, bind 9.11.4-26.P2.el7_9.16, dhcp-libs 4.2.5-83.el7_9.2, dhcp-common 4.2.5-83.el7_9.2, bind-dyndb-ldap 11.1-7.el7_9.1, +11 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) dhcp 4.2.5-83.el7_9.2, dhclient 4.2.5-83.el7_9.2, bind 9.11.4-26.P2.el7_9.16, dhcp-libs 4.2.5-83.el7_9.2, dhcp-common 4.2.5-83.el7_9.2, bind-dyndb-ldap 11.1-7.el7_9.1, +11 morefixed: vendor fix RHSA-2024:3741
-
Red Hat Enterprise Linux CRB (v. 9) bind 9.16.23-18.el9_4.1, bind-libs 9.16.23-18.el9_4.1, bind-utils 9.16.23-18.el9_4.1, bind-chroot 9.16.23-18.el9_4.1, bind-license 9.16.23-18.el9_4.1, python3-bind 9.16.23-18.el9_4.1, +1 morefixed: vendor fix RHSA-2024:2551
-
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) bind 9.8.2-0.68.rc1.el6_10.14, bind-dyndb-ldap 2.3-8.el6_10.1, bind-sdb 9.8.2-0.68.rc1.el6_10.14, bind-libs 9.8.2-0.68.rc1.el6_10.14, bind-utils 9.8.2-0.68.rc1.el6_10.14, bind-chroot 9.8.2-0.68.rc1.el6_10.14fixed: vendor fix RHSA-2025:0039
-
Red Hat Enterprise Linux Server (v. 7 ELS) unbound 1.6.6-5.el7_9.1, unbound-libs 1.6.6-5.el7_9.1, unbound-python 1.6.6-5.el7_9.1fixed: vendor fix RHSA-2024:11003
-
Red Hat Enterprise Linux Server (v. 7) dhcp 4.2.5-83.el7_9.2, dhclient 4.2.5-83.el7_9.2, bind 9.11.4-26.P2.el7_9.16, dhcp-libs 4.2.5-83.el7_9.2, dhcp-common 4.2.5-83.el7_9.2, bind-dyndb-ldap 11.1-7.el7_9.1, +11 morefixed: vendor fix RHSA-2024:3741
-
Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) bind 9.8.2-0.68.rc1.el6_10.14, bind-sdb 9.8.2-0.68.rc1.el6_10.14, bind-libs 9.8.2-0.68.rc1.el6_10.14, bind-utils 9.8.2-0.68.rc1.el6_10.14, bind-chroot 9.8.2-0.68.rc1.el6_10.14fixed: vendor fix RHSA-2025:0039
-
Red Hat Enterprise Linux Server Optional (v. 7 ELS) unbound 1.6.6-5.el7_9.1, unbound-libs 1.6.6-5.el7_9.1, unbound-python 1.6.6-5.el7_9.1fixed: vendor fix RHSA-2024:11003
-
Red Hat Enterprise Linux Server Optional (v. 7) dhcp 4.2.5-83.el7_9.2, dhclient 4.2.5-83.el7_9.2, bind 9.11.4-26.P2.el7_9.16, dhcp-libs 4.2.5-83.el7_9.2, dhcp-common 4.2.5-83.el7_9.2, bind-sdb 9.11.4-26.P2.el7_9.16, +10 more Red Hat Enterprise Linux Workstation (v. 7) dhcp 4.2.5-83.el7_9.2, dhclient 4.2.5-83.el7_9.2, bind 9.11.4-26.P2.el7_9.16, dhcp-libs 4.2.5-83.el7_9.2, dhcp-common 4.2.5-83.el7_9.2, bind-dyndb-ldap 11.1-7.el7_9.1, +11 more Red Hat Enterprise Linux Workstation Optional (v. 7) dhcp 4.2.5-83.el7_9.2, dhclient 4.2.5-83.el7_9.2, bind 9.11.4-26.P2.el7_9.16, dhcp-libs 4.2.5-83.el7_9.2, dhcp-common 4.2.5-83.el7_9.2, bind-sdb 9.11.4-26.P2.el7_9.16, +10 morefixed: vendor fix RHSA-2024:3741
-
Red Hat Enterprise Linux 7 dnsmasq, dnsmasq-utils Red Hat Enterprise Linux 9 dhcp, dhcp-relay, dhcp-client, dhcp-common, dhcp-server Red Hat Enterprise Linux 10 bind, bind-libs, bind-utils, bind-chroot, bind-license, bind-dnssec-utilsnot affected: vulnerable code not present
1 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-24-319-08 updated cvss 7.5
Siemens SINEC INS
-
Siemens SINEC INS <V1.0_SP2_Update_3affected: fixed in V1.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
99.99% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
theregister.com
/2024/02/13/dnssec_vulnerability_internet/
patch, third-party-advisory
-
gitlab.nic.cz
/knot/knot-resolver/-/releases/v5.7.1
patch
-
msrc.microsoft.com
/update-guide/vulnerability/CVE-2023-50387
patch, vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
vendor-advisory, mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
vendor-advisory, mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
vendor-advisory, mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
vendor-advisory
-
nlnetlabs.nl
/news/2024/Feb/13/unbound-1.19.1-released/
vendor-advisory
-
athene-center.de
/aktuelles/key-trap
third-party-advisory
-
kb.isc.org
/docs/cve-2023-50387
third-party-advisory, vdb-entry
-
docs.powerdns.com
/recursor/security-advisories/powerdns-advisory-2024-01.html
third-party-advisory
-
news.ycombinator.com
/item?id=39367411
third-party-advisory
-
securityweek.com
/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/
press/media-coverage, third-party-advisory
-
isc.org
/blogs/2024-bind-security-release/
third-party-advisory
-
news.ycombinator.com
/item?id=39372384
issue-tracking
-
lists.thekelleys.org.uk
/pipermail/dnsmasq-discuss/2024q1/017430.html
mailing-list, third-party-advisory
-
access.redhat.com
/security/cve/CVE-2023-50387
third-party-advisory
-
bugzilla.suse.com
/show_bug.cgi?id=1219823
issue-tracking
-
athene-center.de
/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf
technical-description, third-party-advisory
-
openwall.com
/lists/oss-security/2024/02/16/2
mailing-list
-
openwall.com
/lists/oss-security/2024/02/16/3
mailing-list
-
lists.debian.org
/debian-lts-announce/2024/02/msg00006.html
mailing-list
- security.netapp.com /advisory/ntap-20240307-0007/
-
lists.debian.org
/debian-lts-announce/2024/05/msg00011.html
mailing-list
- lists.debian.org /debian-lts-announce/2024/11/msg00035.html
- lists.debian.org /debian-lts-announce/2024/09/msg00001.html
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
Sources
- CVE List CVE-2023-50387
- NVD CVE-2023-50387
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.