CVE-2023-50387

Processing specially crafted responses coming from DNSSEC-signed zones can lead to uncontrolled CPU usage, leading to a Denial of Service in the DNSSEC-validating resolver side.

This vulnerability applies only for systems where DNSSEC validation is enabled.

This vulnerability in DNSSEC-validating resolvers is of important severity because it can lead to uncontrolled CPU consumption, resulting in a Denial of Service (DoS). By exploiting this flaw, attackers can send specially crafted DNS responses that cause the resolver to enter a state of excessive resource utilization. This can severely impact the availability and performance of DNS services, affecting not only the targeted resolver but potentially cascading to other dependent systems and services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.