CVE-2023-50868

72

FAUCET Score

CVE-2023-50868, dubbed the "NSEC3" issue, is a denial-of-service vulnerability in the DNS protocol's Closest Encloser Proof aspect, affecting products like Debian, Fedora, ISC, NetApp, PowerDNS, and Red Hat. Attackers can exploit this by sending crafted DNSSEC responses during random subdomain attacks, forcing DNS resolvers to perform extensive SHA-1 computations, leading to high CPU consumption. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and a high impact on availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion and media coverage, suggesting awareness within the cybersecurity community.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:hci_baseboard_management_controller:-:::::::*
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:o:netapp:bootstrap_os:-:::::::*
		< 4.8.5CPE matchmatch criteria	cpe:2.3:a:powerdns:recursor::::::::
		>= 4.9.0, < 4.9.3CPE matchmatch criteria	cpe:2.3:a:powerdns:recursor::::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

81.73%

Probability of exploitation in next 30 days

EPSS Percentile

99.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.8173 is in the 100th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (74)

denopatch availablevia llm_extracted

keraspatch availablevia llm_extracted

microsoftpatch availablevia msrc

Product: Windows Server 2012 (Server Core installation)Fixed in: 6.2.9200.24919

microsoftpatch availablevia msrc

Product: Windows Server 2016Fixed in: 10.0.14393.7070

microsoftpatch availablevia msrc

Product: Windows Server 2012 R2 (Server Core installation)Fixed in: 6.3.9600.22023

microsoftpatch availablevia msrc

Product: Windows Server 2012 R2Fixed in: 6.3.9600.22023

microsoftpatch availablevia msrc

Product: Windows Server 2012Fixed in: 6.2.9200.24919

microsoftpatch availablevia msrc

Product: Windows Server 2016 (Server Core installation)Fixed in: 10.0.14393.7070

microsoftpatch availablevia msrc

Product: Windows Server 2019Fixed in: 10.0.17763.5936

microsoftpatch availablevia msrc

Product: Windows Server 2019 (Server Core installation)Fixed in: 10.0.17763.5936

microsoftpatch availablevia msrc

Product: Windows Server 2022Fixed in: 10.0.20348.2527

microsoftpatch availablevia msrc

Product: Windows Server 2022 (Server Core installation)Fixed in: 10.0.20348.2527

microsoftpatch availablevia msrc

Product: Windows Server 2022Fixed in: 10.0.20348.2522

microsoftpatch availablevia msrc

Product: Windows Server 2022 (Server Core installation)Fixed in: 10.0.20348.2522

microsoftpatch availablevia msrc

Product: Windows Server 2022, 23H2 Edition (Server Core installation)Fixed in: 10.0.25398.950

nessuspatch availablevia llm_extracted

Fixed in: 9.18.23-S1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: unbound-0:1.7.3-12.el8_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: unbound-0:1.7.3-12.el8_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: unbound-0:1.7.3-15.el8_4.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: bind-32:9.11.26-4.el8_4.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: dhcp-12:4.3.6-44.el8_4.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: dnsmasq-0:2.79-15.el8_4.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: unbound-0:1.7.3-15.el8_4.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: bind-32:9.11.26-4.el8_4.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: dhcp-12:4.3.6-44.el8_4.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: dnsmasq-0:2.79-15.el8_4.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: unbound-0:1.7.3-15.el8_4.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: bind-32:9.11.26-4.el8_4.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: dhcp-12:4.3.6-44.el8_4.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: dnsmasq-0:2.79-15.el8_4.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: dnsmasq-0:2.79-21.el8_6.5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: bind9.16-32:9.16.23-0.7.el8_6.5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: unbound-0:1.7.3-17.el8_6.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: bind-32:9.11.36-3.el8_6.7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: dhcp-12:4.3.6-47.el8_6.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: unbound-0:1.16.2-5.el8_8.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: dnsmasq-0:2.79-26.el8_8.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: bind9.16-32:9.16.23-0.14.el8_8.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: bind-32:9.11.36-8.el8_8.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: dhcp-12:4.3.6-49.el8_8.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: unbound-0:1.16.2-3.el9_3.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: dnsmasq-0:2.85-14.el9_3.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: bind-32:9.16.23-14.el9_3.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: bind-dyndb-ldap-0:11.9-8.el9_3.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: bind-dyndb-ldap-0:11.9-9.el9_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: dnsmasq-0:2.85-3.el9_0.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: bind-32:9.16.23-1.el9_0.5

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: bind-dyndb-ldap-0:11.9-7.el9_0.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: unbound-0:1.13.1-13.el9_0.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: unbound-0:1.16.2-3.el9_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: dnsmasq-0:2.85-6.el9_2.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: bind-32:9.16.23-11.el9_2.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: bind-dyndb-ldap-0:11.9-8.el9_2.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: bind-32:9.16.23-18.el9_4.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONFixed in: bind-32:9.8.2-0.68.rc1.el6_10.14

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONFixed in: bind-dyndb-ldap-0:2.3-8.el6_10.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: bind-32:9.11.4-26.P2.el7_9.16

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: bind-dyndb-ldap-0:11.1-7.el7_9.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: dhcp-12:4.2.5-83.el7_9.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: unbound-0:1.6.6-5.el7_9.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: unbound-0:1.16.2-5.el8_9.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: dnsmasq-0:2.79-31.el8_9.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: bind9.16-32:9.16.23-0.16.el8_9.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: bind-32:9.11.36-11.el8_9.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: bind-32:9.11.36-14.el8_10

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: unbound-0:1.7.3-12.el8_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: bind-32:9.11.13-6.el8_2.7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: dhcp-12:4.3.6-40.el8_2.3

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: dnsmasq-0:2.79-11.el8_2.3

alistgovendor investigatingvia llm_extracted

consensysvendor investigatingvia llm_extracted

debianvendor investigatingvia nvd_reference

fedoravendor investigatingvia nvd_reference

redhatvendor investigatingvia nvd_reference

Vendor Advisories (7)

denollm-deno-b67a3af2ce0be075CRITICAL

HP ThinPro 8.0 SP 9 Security Updates

kerasllm-keras-7d8c31fee70361dcCRITICAL

HP ThinPro 8.0 SP 9 Security Updates

microsoft2024-Jun/CVE-2023-50868Important

MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU

redhatCVE-2023-50868Important

bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

nessusllm-nessus-18c17f3713786cb6

consensysllm-consensys-30a05de1f80e0395

alistgollm-alistgo-6ca5d3944dd5d86e

Preparing an NSEC3 closest encloser proof can exhaust CPU resources

References

lists.debian.org / debian-lts-announce/2024/09/msg00001.html

Mailing ListVendor Advisory

lists.debian.org / debian-lts-announce/2024/11/msg00035.html

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/[email protected]/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/[email protected]/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/[email protected]/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R

Mailing ListVendor Advisory

access.redhat.com / security/cve/CVE-2023-50868

Vendor Advisory

bugzilla.suse.com / show_bug.cgi

Issue Tracking

datatracker.ietf.org / doc/html/rfc5155

Technical Description

docs.powerdns.com / recursor/security-advisories/powerdns-advisory-2024-01.html

Vendor Advisory

gitlab.nic.cz / knot/knot-resolver/-/releases/v5.7.1

Release Notes

kb.isc.org / docs/cve-2023-50868

Third Party Advisory

lists.debian.org / debian-lts-announce/2024/02/msg00006.html

Mailing ListVendor Advisory

lists.debian.org / debian-lts-announce/2024/05/msg00011.html

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7

Mailing ListVendor Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R

Mailing ListVendor Advisory

lists.thekelleys.org.uk / pipermail/dnsmasq-discuss/2024q1/017430.html

Mailing ListRelease Notes

nlnetlabs.nl / news/2024/Feb/13/unbound-1.19.1-released

Release Notes

security.netapp.com / advisory/ntap-20240307-0008

Vendor Advisory

isc.org / blogs/2024-bind-security-release

ExploitMitigationPress/Media Coverage

openwall.com / lists/oss-security/2024/02/16/2

Issue TrackingMailing List

openwall.com / lists/oss-security/2024/02/16/3

Issue TrackingMailing List