CVE-2023-50387
HighSummary
The KeyTrap vulnerability in the DNSSEC protocol allows a remote attacker to cause a Denial of Service (DoS) by sending DNSSEC responses containing many DNSKEY and RRSIG records. This leads to excessive CPU consumption on the DNS server, potentially causing overload.
Risk Assessment
The organization faces the risk of DNS server overload, which may result in unavailability of network services, including websites and email, for both internal and external users.
Recommendation
It is recommended to immediately apply security patches provided by DNS software vendors (e.g., BIND, Unbound, Knot DNS) and temporarily limit the number of processed DNSSEC records in the server configuration.
Other vulnerabilities in DNS
See all- CVE-2026-6949Medium
A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.
- CVE-2026-52684Low
A DNS issue occurs when the authoritative server responds very slowly and records expire in the meantime. In this case, TTL capping is not enforced due to lack of data. This does not happen during normal resolution.
- CVE-2025-59029Medium
An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then sending a query with qtype set to ANY.
- CVE-2025-2962High
A denial-of-service issue in the DNS implementation could cause an infinite loop. This may lead to a hang or unavailability of the service.
- CVE-2025-1674High
A lack of input validation allows for out-of-bounds reads caused by malicious or malformed packets. This may lead to data disclosure or a crash.
- CVE-2025-1673High
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation. The vulnerability affects DNS packet processing.
- CVE-1999-1379Medium
The vulnerability in DNS allows remote attackers to use DNS name servers as traffic amplifiers. An attacker can send a UDP DNS query with a spoofed source address, resulting in more traffic to the victim than was sent by the attacker.
Original NVD description (English source)
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG r
Vulnerability data from NVD (NIST) · CISA KEV · EPSS