CVE-2023-50387

Q: What is the severity of CVE-2023-50387?

CVE-2023-50387 has a CVSS score of 7.5 (HIGH). CVE-2023-50387 (KeyTrap) is a DNSSEC protocol vulnerability that allows remote attackers to cause denial of service by exhausting CPU resources through specially crafted DNSSEC responses. The vulnerability affects DNS resolvers that validate DNSSEC signatures, particularly when processing zones with many DNSKEY and RRSIG records. This impacts organizations running DNSSEC-validating DNS resolvers like PowerDNS Recursor, BIND, Unbound, and Knot Resolver.

7.5 HIGH

Denial of Service

📋 TL;DR

CVE-2023-50387 (KeyTrap) is a DNSSEC protocol vulnerability that allows remote attackers to cause denial of service by exhausting CPU resources through specially crafted DNSSEC responses. The vulnerability affects DNS resolvers that validate DNSSEC signatures, particularly when processing zones with many DNSKEY and RRSIG records. This impacts organizations running DNSSEC-validating DNS resolvers like PowerDNS Recursor, BIND, Unbound, and Knot Resolver.

💻 Affected Systems

Products:

PowerDNS Recursor
BIND
Unbound
Knot Resolver
Microsoft DNS Server
dnsmasq with DNSSEC
Other DNSSEC-validating resolvers

Versions: All versions prior to patches released in early 2024

Operating Systems: Linux, Windows Server, BSD variants, All OS running affected DNS software

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with DNSSEC validation enabled. Systems without DNSSEC validation are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete DNS resolution service outage for extended periods, making all DNS-dependent services unavailable to users

🟠

Likely Case

Significant performance degradation of DNS resolvers leading to intermittent service disruptions and increased latency

🟢

If Mitigated

Minimal impact with proper rate limiting, query filtering, and updated software

🌐 Internet-Facing: HIGH - DNS resolvers are inherently internet-facing and directly exposed to malicious traffic

🏢 Internal Only: LOW - Only affects systems that process external DNS queries with DNSSEC validation

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending malicious DNSSEC responses to vulnerable resolvers. The attack can be performed remotely without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by vendor: PowerDNS Recursor 4.8.6/4.9.4, BIND 9.16.48/9.18.24/9.19.22, Unbound 1.18.0, Knot Resolver 5.7.2

Vendor Advisory: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html

Restart Required: Yes

Instructions:

1. Identify affected DNS resolver software and version. 2. Check vendor advisory for specific patch version. 3. Apply vendor-recommended update. 4. Restart DNS service. 5. Verify DNSSEC validation is functioning correctly.

🔧 Temporary Workarounds

Disable DNSSEC validation

all

Temporarily disable DNSSEC validation to prevent exploitation while patching

# For PowerDNS Recursor: set dnssec=off in recursor.conf
# For BIND: comment out 'dnssec-validation auto;' in named.conf
# For Unbound: set 'val-permissive-mode: yes' in unbound.conf

Implement rate limiting

all

Limit queries per client to reduce impact of DoS attacks

# For PowerDNS Recursor: max-cache-entries-ratio=0.1
# For BIND: rate-limit { responses-per-second 10; };
# For Unbound: ratelimit: 1000

🧯 If You Can't Patch

Implement network-level filtering to block malicious DNS traffic using IDS/IPS
Deploy redundant DNS resolvers with load balancing to maintain service during attacks

🔍 How to Verify

Check if Vulnerable:

Check DNS resolver version against patched versions. Test with DNSSEC validation enabled using tools like dig to verify resolver behavior.

Check Version:

# PowerDNS: pdns_recursor --version
# BIND: named -v
# Unbound: unbound -V
# Knot Resolver: kresd --version

Verify Fix Applied:

Verify updated version is running and test DNSSEC validation with known good signed domains. Monitor CPU usage during DNSSEC validation.

📡 Detection & Monitoring

Log Indicators:

Unusually high CPU usage on DNS servers
Increased query timeouts
DNSSEC validation failures
Excessive cache misses

Network Indicators:

Spike in DNS query volume
Unusual DNSSEC response patterns
Traffic from unexpected sources to port 53

SIEM Query:

source="dns_server" (cpu_usage>90% AND process="named" OR process="pdns_recursor") | stats count by host

📊 Metadata

CVE ID: CVE-2023-50387

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-770

Published: February 14, 2024

Last Updated: November 4, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Bind by Isc

Bind by Isc

Bind by Isc

Dnsmasq by Thekelleys

Enterprise Linux by Redhat

Enterprise Linux by Redhat

Enterprise Linux by Redhat

Enterprise Linux by Redhat

Fedora by Fedoraproject

Knot Resolver by Nic

Recursor by Powerdns

Recursor by Powerdns

Recursor by Powerdns

Unbound by Nlnetlabs

Windows Server 2008 by Microsoft

Windows Server 2012 by Microsoft

Windows Server 2012 by Microsoft

Windows Server 2016 by Microsoft

Windows Server 2019 by Microsoft

Windows Server 2022 by Microsoft

Windows Server 2022 23h2 by Microsoft

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable DNSSEC validation

Implement rate limiting

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities