CVE-2023-50868
HighThe Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue.
Published Feb 14, 2024 · Updated Aug 12, 2026 · Also known as ALPINE-CVE-2023-50868, DEBIAN-CVE-2023-50868, UBUNTU-CVE-2023-50868
Key Facts
Patch immediately- CVE-2023-50868 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Bind (Isc), Active Iq Unified Manager (Netapp), Hci Baseboard Management Controller (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 74% probability of exploitation in the next 30 days.
- Fixed versions are available, including Bind 2:9.11.36-11.el8_9.1, Bind 2:9.11.36-14.el8_10, Bind 2:9.16.23-18.el9_4.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (30-day exploit likelihood)
74%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2023-50868 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.
Affected Products
718 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| BindIsc | See advisory | 9.16.48 |
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| Hci Baseboard Management ControllerNetapp | See advisory | n/a |
| RecursorPowerdns | See advisory | 4.8.5 |
| Debian LinuxDebian | 10.0, 11.0 | n/a |
Patched Releases
Bind
2:9.11.36-11.el8_9.1, 2:9.11.36-14.el8_10, 2:9.16.23-18.el9_4.1, 32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.36-8.el8_8.4, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16, 32:9.16.23-11.el9_2.4, 32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.23-18.el9_4.1, 32:9.16.48-1.amzn2023.0.1, 32:9.8.2-0.68.rc1.el6_10.14, 9.11.22-3.52.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1, 9.16.48-r0, 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.18.24-1.1, 9.18.24-r0, 9.16.48, 9.18.24
bind-chroot
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16, 32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.48-1.amzn2023.0.1
bind-chrootenv
9.11.22-3.52.1, 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-devel
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16, 32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.48-1.amzn2023.0.1, 9.11.22-3.52.1, 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1
bind-dlz-filesystem
32:9.16.48-1.amzn2023.0.1
bind-dlz-ldap
32:9.16.48-1.amzn2023.0.1
bind-dlz-mysql
32:9.16.48-1.amzn2023.0.1
bind-dlz-sqlite3
32:9.16.48-1.amzn2023.0.1
bind-dnssec-doc
32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.48-1.amzn2023.0.1
bind-dnssec-utils
32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.48-1.amzn2023.0.1
bind-doc
32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.48-1.amzn2023.0.1, 9.11.22-3.52.1, 9.16.48-150400.5.40.1, 9.16.48-150500.8.16.1, 9.16.6-150000.12.74.2, 9.16.6-150300.22.44.1, 9.18.24-1.1
bind-dyndb-ldap
0:11.1-7.el7_9.1, 0:11.9-8.el9_3.3, 0:2.3-8.el6_10.1, 11.1-7.el7_9.1, 11.9-8.el9_3.3, 11.9-8.el9_3.3.alma.1, 11.9-9.el9_4, 11.9-9.el9_4.alma.1
bind-export-devel
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16
bind-export-libs
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16
bind-libs
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16, 32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.48-1.amzn2023.0.1
bind-libs-lite
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16
bind-license
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16, 32:9.16.23-14.el9_3.4, 32:9.16.23-18.0.1.el9_4.1, 32:9.16.48-1.amzn2023.0.1
bind-lite-devel
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16
bind-modules-bdbhpt
9.18.24-1.1
bind-modules-generic
9.18.24-1.1
bind-modules-ldap
9.18.24-1.1
bind-modules-mysql
9.18.24-1.1
bind-modules-perl
9.18.24-1.1
bind-modules-sqlite3
9.18.24-1.1
bind-pkcs11
32:9.11.36-11.el8_9.1, 32:9.11.36-14.el8_10, 32:9.11.4-26.P2.amzn2.13.6, 32:9.11.4-26.P2.el7_9.16, 32:9.16.48-1.amzn2023.0.1
Timeline
Publicly disclosed
Feb 14, 2024
Last updated
Aug 12, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
References
- advisoryRHSA-2024:0965
- advisoryRHSA-2024:0977
- advisoryRHSA-2024:0981
- advisoryRHSA-2024:0982
- advisoryRHSA-2024:11003
FAQ
Common Questions.
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue.
Affected: Bind (Isc); Active Iq Unified Manager (Netapp); Hci Baseboard Management Controller (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Bind 2:9.11.36-11.el8_9.1, Bind 2:9.11.36-14.el8_10, Bind 2:9.16.23-18.el9_4.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2023-50868 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo