CVE-2023-50868: DNS NSEC3 Closest Encloser Proof CPU exhaustion in BIND, PowerDNS, Unbound

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (7.5) availability impact, very high EPSS and an Exploit-tagged reference make this a realistic denial-of-service risk for exposed DNS resolvers, though it is not in KEV.

What it is

The NSEC3 closest encloser proof in DNSSEC (RFC 5155) can force a resolver to perform thousands of SHA-1 hash iterations per response when RFC 9276 guidance is skipped. Remote attackers can abuse this with random subdomain queries to exhaust CPU on recursive resolvers. It matters because DNS resolution is a shared, high-availability service and sustained CPU load degrades or halts it.

Impact

An attacker can drive sustained CPU consumption on recursive DNS resolvers, causing slow or failed resolution for all clients served by that resolver. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reached over the network by sending crafted DNSSEC responses or triggering NSEC3 processing through recursive queries; the CVSS vector shows no privileges and no user interaction required. Any resolver that processes NSEC3 records without the RFC 9276 iteration limits is exposed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is very high (0.817, 99.6th percentile) and one ISC reference is tagged Exploit, indicating public exploitation interest.

What to do

• Patch affected BIND, PowerDNS Recursor, Unbound, Knot Resolver, dnsmasq and distribution packages to the fixed releases referenced in vendor advisories.
• Apply RFC 9276 guidance to cap NSEC3 hash iterations on authoritative and recursive servers where configuration allows.
• Rate-limit or restrict recursive DNS exposure to trusted clients and monitor for random subdomain query patterns.
• Where patching is delayed, reduce resolver recursion exposure and add CPU headroom or failover capacity for DNS services.

Detection

• Monitor recursive resolver CPU and query latency for sustained spikes correlated with high volumes of NSEC3 or random subdomain queries.
• Alert on unusually high rates of NXDOMAIN or random-label queries from single sources against recursive resolvers.
• Track resolver process CPU time per query and baseline deviations on BIND, PowerDNS Recursor and Unbound hosts.
• Review DNS query logs for repeated closest-encloser proof patterns or high-iteration NSEC3 responses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.