CVE-2023-50868

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 74.30 % · percentile 99 (2026-10-29)
State: PUBLISHED
Published: 2024-02-14 00:00 UTC
Updated: 2025-11-04 18:20 UTC
Assigner: mitre
NVD status: Analyzed

Search on…

Description

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

Weaknesses (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

European references

ENISA EUVD · EUVD-2023-55601
GCVE · GCVE-0-2023-50868

CERT-FR advisories

CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0018 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
CERTFR-2024-AVI-0713 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2024-AVI-0627 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2024-AVI-0506 — Multiples vulnérabilités dans Juniper Secure Analytics · cert.ssi.gouv.fr
CERTFR-2024-AVI-0486 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr
CERTFR-2024-AVI-0470 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0385 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2024-AVI-0122 — Multiples vulnérabilités dans Bind · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:netapp:hci_baseboard_management_controller:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* < 4.8.5
cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* ≥ 4.9.0 < 4.9.3
cpe:2.3:a:powerdns:recursor:*:*:*:*:*:*:*:* ≥ 5.0.0 < 5.0.2
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.4:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.0.0 < 9.16.48
cpe:2.3:a:isc:bind:*:*:*:*:supported_preview:*:*:* ≥ 9.9.3 < 9.16.48
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.18.0 < 9.18.24
cpe:2.3:a:isc:bind:*:s1:*:*:supported_preview:*:*:* ≥ 9.18.11 < 9.18.24
cpe:2.3:a:isc:bind:*:*:*:*:-:*:*:* ≥ 9.19.0 < 9.19.21

Affected products

Product	Versions
	affected n/a

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ CVE-2023-50868