What is CVE-2023-50387?

CVE-2023-50387 is a high-severity vulnerability in Isc Bind, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2024-02-14.

How severe is CVE-2023-50387?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2023-50387 known to be exploited?

22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Isc Bind

CVE-2023-50387

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Published 2024-02-14 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 1.000 (100.0th percentile), scored 2026-10-29.

Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 1.000 · newest: 1.000 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

Public proof-of-concept exploits

References

www.athene-center.de/aktuelles/key-trap (Third Party Advisory)
nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ (Vendor Advisory)
kb.isc.org/docs/cve-2023-50387 (VDB Entry, Third Party Advisory)
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html (Third Party Advisory)
www.theregister.com/2024/02/13/dnssec_vulnerability_internet/ (Patch, Third Party Advisory)
news.ycombinator.com/item (Third Party Advisory)
www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-r… (Third Party Advisory, Press/Media Coverage)
www.isc.org/blogs/2024-bind-security-release/ (Third Party Advisory)
news.ycombinator.com/item (Issue Tracking)
gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 (Patch)

Frequently asked questions

What is CVE-2023-50387?: CVE-2023-50387 is a high-severity vulnerability in Isc Bind, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2024-02-14.
How severe is CVE-2023-50387?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2023-50387 known to be exploited?: 22 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.