What is CVE-2023-50868?

CVE-2023-50868 is a high-severity vulnerability in Isc Bind, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2024-02-14.

How severe is CVE-2023-50868?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2023-50868 known to be exploited?

15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Isc Bind

CVE-2023-50868

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Vulnerability class: DoS (Denial of Service)

Published 2024-02-14 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.743 (99.5th percentile), scored 2026-10-28.

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.737 · newest: 0.743 · change: +0.006

Affected products

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

Public proof-of-concept exploits

References

nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ (Release Notes)
docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html (Vendor Advisory)
www.isc.org/blogs/2024-bind-security-release/ (Exploit, Mitigation, Press/Media Coverage)
datatracker.ietf.org/doc/html/rfc5155 (Technical Description)
kb.isc.org/docs/cve-2023-50868 (Third Party Advisory)
gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 (Release Notes)
lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html (Mailing List, Release Notes)
access.redhat.com/security/cve/CVE-2023-50868 (Vendor Advisory)
bugzilla.suse.com/show_bug.cgi (Issue Tracking)
www.openwall.com/lists/oss-security/2024/02/16/2 (mailing-list, Mailing List, Issue Tracking)

Frequently asked questions

What is CVE-2023-50868?: CVE-2023-50868 is a high-severity vulnerability in Isc Bind, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2024-02-14.
How severe is CVE-2023-50868?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2023-50868 known to be exploited?: 15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.