CVE-2023-50387

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-50387 is a denial-of-service vulnerability in DNSSEC processing as defined in RFCs 4033, 4034, 4035, 6840 and related specifications. It stems from the requirement that validating resolvers evaluate every combination of DNSKEY and RRSIG records when a zone publishes many such records, resulting in excessive CPU consumption. The flaw, tracked as CWE-770 and nicknamed KeyTrap, affects any DNS resolver or authoritative server that implements the DNSSEC validation algorithm without additional safeguards.

An unauthenticated remote attacker can trigger the issue by sending one or more crafted DNSSEC responses that force the target to perform the full combinatorial evaluation. Successful exploitation produces sustained high CPU load and can render the resolver unresponsive, achieving a denial-of-service condition without any privileges or user interaction. The CVSS 3.1 base score of 7.5 reflects network attack vector, low complexity, and high availability impact.

Vendor advisories from Red Hat, SUSE, PowerDNS and coordinated lists on oss-security describe the problem and point to forthcoming patches or configuration work-arounds that limit the number of signatures or keys processed per response. The associated EPSS score rose from a low baseline to a peak of 0.5199 on 2026-03-20 before receding to the current value of 0.4321, indicating measurable post-disclosure exploitation interest that warrants renewed monitoring.