Every CVE Search/ Get API key

CVE-2023-50387

Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers...

7.5 HighPublic exploitFix available

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

100.0%Up 99.9 points since Feb 15, 2024
90%50%10%1%

What each source reports

NVD Score used 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
CVE-2023-50387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
CVE List 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
CVE-2023-50387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2023-55182 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
EUVD-2023-55182
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-8459-gg55-8qjj 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers...

Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
GHSA-8459-gg55-8qjj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2023-50387 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
ALPINE-CVE-2023-50387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-34350 7.5

CVE-2023-50387 affecting package bind for versions less than 9.16.48-1

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
AZL-34350
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVAZL-34419 7.5

CVE-2023-50387 affecting package dnsmasq for versions less than 2.90-1

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
AZL-34419
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-34440 7.5

CVE-2023-50387 affecting package unbound for versions less than 1.19.1-1

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
AZL-34440
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-34559 7.5

CVE-2023-50387 affecting package bind for versions less than 9.20.0-1

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
AZL-34559
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-35328 7.5

CVE-2023-50387 affecting package unbound for versions less than 1.19.1-1

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
AZL-35328
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2023-50387 7.5
Record
BELL-CVE-2023-50387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
CVE-2023-50387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-50387 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
DEBIAN-CVE-2023-50387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1210 8.0

unbound security update

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS which allows clients to encrypt their communication. Unbound is available for most platforms such as FreeBSD, OpenBSD, NetBSD, MacOS, Linux and Microsoft Windows. Unbound is a totally free, open source software under the BSD license. It doesn't make custom builds or provide specific features to paying customers only.

Security Fix(es):

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.(CVE-2023-50868)

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.(CVE-2024-1488)

Record
OESA-2024-1210
CVSS 3.1
8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1323 7.5

bind security update

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

  • nxdomain-redirect <domain>; is configured, and
  • the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

Record
OESA-2024-1323
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1324 7.5

bind security update

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

  • nxdomain-redirect <domain>; is configured, and
  • the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

Record
OESA-2024-1324
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1325 7.5

bind security update

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

  • nxdomain-redirect <domain>; is configured, and
  • the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

Record
OESA-2024-1325
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1326 7.5

bind security update

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected named instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-4408)

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

A flaw in query-handling code can cause named to exit prematurely with an assertion failure when:

  • nxdomain-redirect <domain>; is configured, and
  • the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. This issue affects BIND 9 versions 9.12.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5517)

A bad interaction between DNS64 and serve-stale may cause named to crash with an assertion failure during recursive resolution, when both of these features are enabled. This issue affects BIND 9 versions 9.16.12 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.16.12-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.(CVE-2023-5679)

To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up the database. It uses several methods, including some that are asynchronous: a small chunk of memory pointing to the cache element that can be cleaned up is first allocated and then queued for later processing. It was discovered that if the resolver is continuously processing query patterns triggering this type of cache-database maintenance, named may not be able to handle the cleanup events in a timely manner. This in turn enables the list of queued cleanup events to grow infinitely large over time, allowing the configured max-cache-size limit to be significantly exceeded. This issue affects BIND 9 versions 9.16.0 through 9.16.45 and 9.16.8-S1 through 9.16.45-S1.(CVE-2023-6516)

Record
OESA-2024-1326
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1489 7.5

systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.(CVE-2023-50868)

Record
OESA-2024-1489
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2609 7.5

bind security update

Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server.

Security Fix(es):

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.(CVE-2023-50387)

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.(CVE-2023-50868)

Record
OESA-2025-2609
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:0965 7.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:0965
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:0977 7.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:0977
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:0981 7.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:0981
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:0982 7.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:0982
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:11003 7.5

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:11003
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1334 7.5

Red Hat Security Advisory: dnsmasq security update

Record
RHSA-2024:1334
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1335 7.5

Red Hat Security Advisory: dnsmasq security update

Record
RHSA-2024:1335
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1522 7.5

Red Hat Security Advisory: dnsmasq security update

Record
RHSA-2024:1522
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1543 7.5

Red Hat Security Advisory: dnsmasq security update

Record
RHSA-2024:1543
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1544 7.5

Red Hat Security Advisory: dnsmasq security and bug fix update

Record
RHSA-2024:1544
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1545 7.5

Red Hat Security Advisory: dnsmasq security update

Record
RHSA-2024:1545
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1647 7.5

Red Hat Security Advisory: bind9.16 security update

Record
RHSA-2024:1647
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1648 7.5

Red Hat Security Advisory: bind9.16 security update

Record
RHSA-2024:1648
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1781 7.5

Red Hat Security Advisory: bind9.16 security update

Record
RHSA-2024:1781
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1782 7.5

Red Hat Security Advisory: bind and dhcp security update

Record
RHSA-2024:1782
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1789 7.5

Red Hat Security Advisory: bind security update

Record
RHSA-2024:1789
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1800 7.5

Red Hat Security Advisory: bind and bind-dyndb-ldap security updates

Record
RHSA-2024:1800
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1801 8.0

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:1801
CVSS 3.1
8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:1803 7.5

Red Hat Security Advisory: bind and bind-dyndb-ldap security updates

Record
RHSA-2024:1803
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:1804 8.0

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:1804
CVSS 3.1
8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2551 7.5

Red Hat Security Advisory: bind security update

Record
RHSA-2024:2551
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2587 8.0

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:2587
CVSS 3.1
8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2696 8.0

Red Hat Security Advisory: unbound security update

Record
RHSA-2024:2696
CVSS 3.1
8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:2720 7.5

Red Hat Security Advisory: bind and dhcp security update

Record
RHSA-2024:2720
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2721 7.5

Red Hat Security Advisory: bind and dhcp security update

Record
RHSA-2024:2721
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2821 7.5

Red Hat Security Advisory: bind and dhcp security update

Record
RHSA-2024:2821
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:2890 7.5

Red Hat Security Advisory: bind and dhcp security update

Record
RHSA-2024:2890
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:3271 7.5

Red Hat Security Advisory: bind and dhcp security update

Record
RHSA-2024:3271
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:3741 7.5

Red Hat Security Advisory: bind, bind-dyndb-ldap, and dhcp security update

Record
RHSA-2024:3741
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:3877 7.5

Red Hat Security Advisory: dnsmasq security update

Record
RHSA-2024:3877
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:3929 7.5

Red Hat Security Advisory: dnsmasq security update

Record
RHSA-2024:3929
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:0039 7.5

Red Hat Security Advisory: bind and bind-dyndb-ldap security update

Record
RHSA-2025:0039
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-50387 7.5

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Record
UBUNTU-CVE-2023-50387
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2024:0965 No score

Important: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

Security Fix(es):

  • bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
  • bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:0965
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
bind
Alpine:v3.16
 9.0.0 up to 9.16.48-r0
9.16.48-r0
bind
Alpine:v3.17
 9.0.0 up to 9.18.24-r0
9.18.24-r0
bind
Alpine:v3.18
 9.0.0 up to 9.18.24-r0
9.18.24-r0
bind
Alpine:v3.19
 9.0.0 up to 9.18.24-r0
9.18.24-r0
bind
Alpine:v3.20
 9.0.0 up to 9.18.24-r0
9.18.24-r0
bind
Alpine:v3.21
 9.0.0 up to 9.18.24-r0
9.18.24-r0
bind
Alpine:v3.22
 9.0.0 up to 9.18.24-r0
9.18.24-r0
bind
Alpine:v3.23
 9.0.0 up to 9.18.24-r0
9.18.24-r0
bind
Alpine:v3.24
 9.0.0 up to 9.18.24-r0
9.18.24-r0
dnsmasq
Alpine:v3.17
 before 2.90-r0
2.90-r0
Show 290 moreShow less
Affected packages
PackageAffectedFixed
dnsmasq
Alpine:v3.18
 before 2.90-r0
2.90-r0
dnsmasq
Alpine:v3.19
 before 2.90-r0
2.90-r0
dnsmasq
Alpine:v3.20
 before 2.90-r0
2.90-r0
dnsmasq
Alpine:v3.21
 before 2.90-r0
2.90-r0
dnsmasq
Alpine:v3.22
 before 2.90-r0
2.90-r0
dnsmasq
Alpine:v3.23
 before 2.90-r0
2.90-r0
dnsmasq
Alpine:v3.24
 before 2.90-r0
2.90-r0
knot-resolver
Alpine:v3.18
 before 5.7.1-r0
5.7.1-r0
knot-resolver
Alpine:v3.19
 before 5.7.1-r0
5.7.1-r0
knot-resolver
Alpine:v3.20
 before 5.7.1-r0
5.7.1-r0
knot-resolver
Alpine:v3.21
 before 5.7.1-r0
5.7.1-r0
knot-resolver
Alpine:v3.22
 before 5.7.1-r0
5.7.1-r0
knot-resolver
Alpine:v3.23
 before 5.7.1-r0
5.7.1-r0
knot-resolver
Alpine:v3.24
 before 5.7.1-r0
5.7.1-r05.7.7-r0
pdns-recursor
Alpine:v3.18
 before 4.9.3-r0
4.9.3-r0
pdns-recursor
Alpine:v3.19
 before 4.9.3-r0
4.9.3-r0
pdns-recursor
Alpine:v3.20
 before 5.0.2-r0
5.0.2-r0
pdns-recursor
Alpine:v3.21
 before 5.0.2-r0
5.0.2-r0
pdns-recursor
Alpine:v3.22
 before 5.0.2-r0
5.0.2-r0
pdns-recursor
Alpine:v3.23
 before 5.0.2-r0
5.0.2-r0
pdns-recursor
Alpine:v3.24
 before 5.0.2-r0
5.0.2-r0
unbound
Alpine:v3.17
 before 1.19.1-r0
1.19.1-r0
unbound
Alpine:v3.18
 before 1.19.1-r0
1.19.1-r0
unbound
Alpine:v3.19
 before 1.19.1-r0
1.19.1-r0
unbound
Alpine:v3.20
 before 1.19.1-r0
1.19.1-r0
unbound
Alpine:v3.21
 before 1.19.1-r0
1.19.1-r0
unbound
Alpine:v3.22
 before 1.19.1-r0
1.19.1-r0
unbound
Alpine:v3.23
 before 1.19.1-r0
1.19.1-r0
unbound
Alpine:v3.24
 before 1.19.1-r0
1.19.1-r0
python3-unbound
AlmaLinux:8
 before 1.16.2-5.el8_9.2
1.16.2-5.el8_9.2
unbound
AlmaLinux:8
 before 1.16.2-5.el8_9.2
1.16.2-5.el8_9.2
unbound-devel
AlmaLinux:8
 before 1.16.2-5.el8_9.2
1.16.2-5.el8_9.2
unbound-libs
AlmaLinux:8
 before 1.16.2-5.el8_9.2
1.16.2-5.el8_9.2
python3-unbound
AlmaLinux:9
 before 1.16.2-3.el9_3.1
1.16.2-3.el9_3.1
unbound
AlmaLinux:9
 before 1.16.2-3.el9_3.1
1.16.2-3.el9_3.1
unbound-devel
AlmaLinux:9
 before 1.16.2-3.el9_3.1
1.16.2-3.el9_3.1
unbound-libs
AlmaLinux:9
 before 1.16.2-3.el9_3.1
1.16.2-3.el9_3.1
dnsmasq
AlmaLinux:9
 before 2.85-14.el9_3.1
2.85-14.el9_3.1
dnsmasq-utils
AlmaLinux:9
 before 2.85-14.el9_3.1
2.85-14.el9_3.1
dnsmasq
AlmaLinux:8
 before 2.79-31.el8_9.2
2.79-31.el8_9.2
dnsmasq-utils
AlmaLinux:8
 before 2.79-31.el8_9.2
2.79-31.el8_9.2
bind9.16
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind9.16-chroot
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind9.16-devel
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind9.16-dnssec-utils
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind9.16-doc
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind9.16-libs
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind9.16-license
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind9.16-utils
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
python3-bind9.16
AlmaLinux:8
 before 32:9.16.23-0.16.el8_9.2.alma.1
32:9.16.23-0.16.el8_9.2.alma.1
bind
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-chroot
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-devel
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-export-devel
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-export-libs
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-libs
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-libs-lite
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-license
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-lite-devel
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-pkcs11
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-pkcs11-devel
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-pkcs11-libs
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-pkcs11-utils
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-sdb
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-sdb-chroot
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind-utils
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
python3-bind
AlmaLinux:8
 before 32:9.11.36-11.el8_9.1
32:9.11.36-11.el8_9.1
bind
AlmaLinux:9
 before 32:9.16.23-14.el9_3.4
32:9.16.23-14.el9_3.4
bind
Azure Linux:2
 before 9.16.48-1
9.16.48-1
dnsmasq
Azure Linux:2
 before 2.90-1
2.90-1
unbound
Azure Linux:2
 before 1.19.1-1
1.19.1-1
bind
Azure Linux:3
 before 9.20.0-1
9.20.0-1
unbound
Azure Linux:3
 before 1.19.1-1
1.19.1-1
bind
Alpaquita:23
 9.18.11-r0 up to 9.18.24-r0
9.18.24-r0
dnsmasq
Alpaquita:23
 2.87-r0 up to 2.90-r0
2.90-r0
bind
Alpaquita:stream
 9.18.16-r0 up to 9.18.24-r0
9.18.24-r0
dnsmasq
Alpaquita:stream
 2.89-r2 up to 2.90-r0
2.90-r0
bind
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-chroot
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-devel
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-dnssec-doc
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-dnssec-utils
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-doc
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-libs
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-license
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind-utils
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
python3-bind
TuxCare:AlmaLinux:9.2
 before 32:9.16.23-11.el9_2.2.tuxcare.els1
32:9.16.23-11.el9_2.2.tuxcare.els1
bind
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-chroot
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-devel
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-export-devel
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-export-libs
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-libs
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-libs-lite
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-license
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-lite-devel
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-pkcs11
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-pkcs11-devel
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-pkcs11-libs
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-pkcs11-utils
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-sdb
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-sdb-chroot
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind-utils
TuxCare:CentOS:7
 before 32:9.11.4-26.P2.el7.14.tuxcare.els2
32:9.11.4-26.P2.el7.14.tuxcare.els2
bind
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-chroot
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-export-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-export-libs
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-libs
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-libs-lite
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-license
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-lite-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-pkcs11
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-pkcs11-devel
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-pkcs11-libs
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind-pkcs11-utils
TuxCare:CentOS:8.4
 before 32:9.11.26-4.el8.4.tuxcare.els7
32:9.11.26-4.el8.4.tuxcare.els7
bind9
Debian:12
 before 1:9.18.24-1, plus listed versions
1:9.18.12-11:9.18.13-11:9.18.16-11:9.18.16-1~deb12u11:9.18.16-1~deb12u1~bpo11+11:9.18.19-1~deb12u11:9.18.19-1~deb12u1~bpo11+11:9.18.24-1~bpo11+1
1:9.18.24-1
bind9
Debian:13
 before 1:9.19.21-1
1:9.19.21-1
bind9
Debian:14
 before 1:9.19.21-1
1:9.19.21-1
dnsjava
Debian:12
 All versions, plus listed versions
2.1.8-23.6.2-13.6.2-23.6.3-1
 None known
dnsjava
Debian:13
 before 3.6.2-1
3.6.2-1
dnsjava
Debian:14
 before 3.6.2-1
3.6.2-1
dnsmasq
Debian:12
 before 2.90-4~deb12u1, plus listed versions
2.89-12.90-12.90-22.90-3
2.90-4~deb12u1
dnsmasq
Debian:13
 before 2.90-1
2.90-1
dnsmasq
Debian:14
 before 2.90-1
2.90-1
knot-resolver
Debian:12
 before 5.6.0-1+deb12u1, plus listed versions
5.6.0-1
5.6.0-1+deb12u1
knot-resolver
Debian:13
 before 5.7.1-1
5.7.1-1
knot-resolver
Debian:14
 before 5.7.1-1
5.7.1-1
pdns-recursor
Debian:12
 before 4.8.6-1, plus listed versions
4.8.4-1
4.8.6-1
pdns-recursor
Debian:13
 before 4.9.3-1
4.9.3-1
pdns-recursor
Debian:14
 before 4.9.3-1
4.9.3-1
systemd
Debian:12
 before 252.23-1~deb12u1, plus listed versions
252.11-1252.11-1~deb12u1252.12-1~deb12u1252.14-1~deb12u1252.16-1~deb12u1
Show 8 moreShow less
252.17-1~deb12u1252.18-1~deb12u1252.19-1~deb12u1252.20-1~deb12u1252.21-1~deb12u1252.22-1~deb12u1252.6-1252.6-1+loong64
252.23-1~deb12u1
systemd
Debian:13
 before 255.4-1
255.4-1
systemd
Debian:14
 before 255.4-1
255.4-1
unbound
Debian:12
 before 1.17.1-2+deb12u2, plus listed versions
1.17.1-21.17.1-2+deb12u1
1.17.1-2+deb12u2
unbound
Debian:13
 before 1.19.1-1
1.19.1-1
unbound
Debian:14
 before 1.19.1-1
1.19.1-1
unbound
Debian:10
 before 1.9.0-2+deb10u4, plus listed versions
1.9.0-21.9.0-2+deb10u11.9.0-2+deb10u21.9.0-2+deb10u3
1.9.0-2+deb10u4
bind9
Debian:10
 before 1:9.11.5.P4+dfsg-5.1+deb10u11, plus listed versions
1:9.11.5.P4+dfsg-5.11:9.11.5.P4+dfsg-5.1+deb10u11:9.11.5.P4+dfsg-5.1+deb10u101:9.11.5.P4+dfsg-5.1+deb10u21:9.11.5.P4+dfsg-5.1+deb10u3
Show 6 moreShow less
1:9.11.5.P4+dfsg-5.1+deb10u41:9.11.5.P4+dfsg-5.1+deb10u51:9.11.5.P4+dfsg-5.1+deb10u61:9.11.5.P4+dfsg-5.1+deb10u71:9.11.5.P4+dfsg-5.1+deb10u81:9.11.5.P4+dfsg-5.1+deb10u9
1:9.11.5.P4+dfsg-5.1+deb10u11
systemd
Debian:11
 before 247.3-7+deb11u6, plus listed versions
247.3-6247.3-7247.3-7+deb11u1247.3-7+deb11u2247.3-7+deb11u3247.3-7+deb11u4247.3-7+deb11u5
247.3-7+deb11u6
dnsmasq
Debian:11
 before 2.85-1+deb11u1, plus listed versions
2.85-1
2.85-1+deb11u1
unbound
Debian:11
 before 1.13.1-1+deb11u2, plus listed versions
1.13.1-11.13.1-1+deb11u1
1.13.1-1+deb11u2
bind9
Debian:11
 before 1:9.16.48-1, plus listed versions
1:9.16.15-11:9.16.21-11:9.16.21-1+hurd.11:9.16.22-1~deb11u11:9.16.22-1~deb11u1~bpo10+1
Show 6 moreShow less
1:9.16.27-1~deb11u11:9.16.27-1~deb11u1~bpo10+11:9.16.33-1~deb11u11:9.16.37-1~deb11u11:9.16.42-1~deb11u11:9.16.44-1~deb11u1
1:9.16.48-1
bind
Mageia:9
 before 9.18.15-2.3.mga9
9.18.15-2.3.mga9
unbound
Mageia:9
 before 1.19.1-1.mga9
1.19.1-1.mga9
dnsmasq
Mageia:9
 before 2.90-1.mga9
2.90-1.mga9
unbound
openEuler:20.03-LTS-SP1
 before 1.11.0-11.oe1
1.11.0-11.oe1
unbound
openEuler:20.03-LTS-SP4
 before 1.11.0-11.oe2003sp4
1.11.0-11.oe2003sp4
unbound
openEuler:22.03-LTS
 before 1.13.2-10.oe2203sp3
1.13.2-10.oe2203sp3
unbound
openEuler:22.03-LTS-SP1
 before 1.13.2-10.oe2203sp1
1.13.2-10.oe2203sp1
unbound
openEuler:22.03-LTS-SP2
 before 1.13.2-10.oe2203sp2
1.13.2-10.oe2203sp2
unbound
openEuler:22.03-LTS-SP3
 before 1.13.2-10.oe2203sp3
1.13.2-10.oe2203sp3
bind
openEuler:22.03-LTS
 before 9.16.23-21.oe2203
9.16.23-21.oe2203
bind
openEuler:22.03-LTS-SP1
 before 9.16.23-21.oe2203sp1
9.16.23-21.oe2203sp1
bind
openEuler:22.03-LTS-SP2
 before 9.16.23-22.oe2203sp2
9.16.23-22.oe2203sp2
bind
openEuler:22.03-LTS-SP3
 before 9.16.23-22.oe2203sp3
9.16.23-22.oe2203sp3
systemd
openEuler:20.03-LTS-SP1
 before 243-78.oe1
243-78.oe1
systemd
openEuler:20.03-LTS-SP4
 before 243-78.oe2003sp4
243-78.oe2003sp4
systemd
openEuler:22.03-LTS
 before 249-77.oe2203sp3
249-77.oe2203sp3
systemd
openEuler:22.03-LTS-SP1
 before 249-75.oe2203sp1
249-75.oe2203sp1
systemd
openEuler:22.03-LTS-SP2
 before 249-74.oe2203sp2
249-74.oe2203sp2
systemd
openEuler:22.03-LTS-SP3
 before 249-77.oe2203sp3
249-77.oe2203sp3
bind
openEuler:20.03-LTS-SP4
 before 9.11.21-21.oe2003sp4
9.11.21-21.oe2003sp4
python3-unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
python3-unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
unbound
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
unbound-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
unbound-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
unbound-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
unbound-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
unbound-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.16.2-5.el8_9.2
0:1.16.2-5.el8_9.2
python3-unbound
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
python3-unbound-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-libs
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
python3-unbound-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-devel
Red Hat:enterprise_linux:9::crb
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
unbound-libs-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.16.2-3.el9_3.1
0:1.16.2-3.el9_3.1
python3-unbound
Red Hat:rhel_eus:9.2::appstream
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
python3-unbound-debuginfo
Red Hat:rhel_eus:9.2::appstream
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound
Red Hat:rhel_eus:9.2::appstream
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-debuginfo
Red Hat:rhel_eus:9.2::appstream
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-debugsource
Red Hat:rhel_eus:9.2::appstream
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-libs
Red Hat:rhel_eus:9.2::appstream
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-libs-debuginfo
Red Hat:rhel_eus:9.2::appstream
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
python3-unbound-debuginfo
Red Hat:rhel_eus:9.2::crb
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-debuginfo
Red Hat:rhel_eus:9.2::crb
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-debugsource
Red Hat:rhel_eus:9.2::crb
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-devel
Red Hat:rhel_eus:9.2::crb
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
unbound-libs-debuginfo
Red Hat:rhel_eus:9.2::crb
 before 0:1.16.2-3.el9_2.1
0:1.16.2-3.el9_2.1
python3-unbound
Red Hat:rhel_eus:8.8::appstream
 before 0:1.16.2-5.el8_8.1
0:1.16.2-5.el8_8.1
python3-unbound-debuginfo
Red Hat:rhel_eus:8.8::appstream
 before 0:1.16.2-5.el8_8.1
0:1.16.2-5.el8_8.1
unbound
Red Hat:rhel_eus:8.8::appstream
 before 0:1.16.2-5.el8_8.1
0:1.16.2-5.el8_8.1
unbound-debuginfo
Red Hat:rhel_eus:8.8::appstream
 before 0:1.16.2-5.el8_8.1
0:1.16.2-5.el8_8.1
unbound-debugsource
Red Hat:rhel_eus:8.8::appstream
 before 0:1.16.2-5.el8_8.1
0:1.16.2-5.el8_8.1
unbound-devel
Red Hat:rhel_eus:8.8::appstream
 before 0:1.16.2-5.el8_8.1
0:1.16.2-5.el8_8.1
unbound-libs
Red Hat:rhel_eus:8.8::appstream
 before 0:1.16.2-5.el8_8.1
0:1.16.2-5.el8_8.1
dnsmasq
Rocky Linux:8
 before 0:2.79-31.el8_9.2
0:2.79-31.el8_9.2
bind9.16
Rocky Linux:8
 before 2:9.16.23-0.16.el8_9.2
2:9.16.23-0.16.el8_9.2
bind
Rocky Linux:8
 before 2:9.11.36-11.el8_9.1
2:9.11.36-11.el8_9.1
dhcp
Rocky Linux:8
 before 2:4.3.6-49.el8_9.1
2:4.3.6-49.el8_9.1
bind
Rocky Linux:9
 before 2:9.16.23-18.el9_4.1
2:9.16.23-18.el9_4.1
bind-dyndb-ldap
Rocky Linux:9
 before 0:11.9-9.el9_4
0:11.9-9.el9_4
bind
Rocky Linux:8
 before 2:9.11.36-14.el8_10
2:9.11.36-14.el8_10
dhcp
Rocky Linux:8
 before 2:4.3.6-50.el8_10
2:4.3.6-50.el8_10
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 9.16.48-150500.8.16.1
9.16.48-150500.8.16.1
bind
SUSE:Linux Enterprise Module for Server Applications 15 SP5
 before 9.16.48-150500.8.16.1
9.16.48-150500.8.16.1
bind
openSUSE:Leap 15.5
 before 9.16.48-150500.8.16.1
9.16.48-150500.8.16.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 9.16.48-150400.5.40.1
9.16.48-150400.5.40.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 9.16.48-150400.5.40.1
9.16.48-150400.5.40.1
bind
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 9.16.48-150400.5.40.1
9.16.48-150400.5.40.1
bind
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 9.16.48-150400.5.40.1
9.16.48-150400.5.40.1
bind
SUSE:Manager Proxy 4.3
 before 9.16.48-150400.5.40.1
9.16.48-150400.5.40.1
bind
SUSE:Manager Server 4.3
 before 9.16.48-150400.5.40.1
9.16.48-150400.5.40.1
bind
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 9.11.22-3.52.1
9.11.22-3.52.1
bind
SUSE:Linux Enterprise Server 12 SP5
 before 9.11.22-3.52.1
9.11.22-3.52.1
bind
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 9.11.22-3.52.1
9.11.22-3.52.1
unbound
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 1.20.0-150600.23.3.1
1.20.0-150600.23.3.1
unbound
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 1.20.0-150600.23.3.1
1.20.0-150600.23.3.1
unbound
openSUSE:Leap 15.6
 before 1.20.0-150600.23.3.1
1.20.0-150600.23.3.1
bind
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 9.16.6-150300.22.44.1
9.16.6-150300.22.44.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 9.16.6-150300.22.44.1
9.16.6-150300.22.44.1
bind
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 9.16.6-150300.22.44.1
9.16.6-150300.22.44.1
bind
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 9.16.6-150300.22.44.1
9.16.6-150300.22.44.1
bind
SUSE:Enterprise Storage 7.1
 before 9.16.6-150300.22.44.1
9.16.6-150300.22.44.1
unbound
SUSE:Linux Enterprise Micro 5.5
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Manager Proxy 4.3
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Manager Server 4.3
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
SUSE:Enterprise Storage 7.1
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
unbound
openSUSE:Leap 15.5
 before 1.20.0-150100.10.13.1
1.20.0-150100.10.13.1
bind
SUSE:Manager Client Tools for SLE Micro 5
 before 9.16.6-150000.12.74.2
9.16.6-150000.12.74.2
libuv
SUSE:Manager Client Tools for SLE Micro 5
 before 1.18.0-150000.3.2.1
1.18.0-150000.3.2.1
bind
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 9.16.6-150000.12.74.2
9.16.6-150000.12.74.2
libuv
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.18.0-150000.3.2.1
1.18.0-150000.3.2.1
dnsmasq
openSUSE:Leap Micro 5.5
 before 2.90-150400.16.3.1
2.90-150400.16.3.1
dnsmasq
openSUSE:Leap 15.6
 before 2.90-150400.16.3.1
2.90-150400.16.3.1
bind9
Ubuntu:Pro:14.04:LTS
 before 1:9.9.5.dfsg-3ubuntu0.19+esm12, plus listed versions
1:9.9.3.dfsg.P2-4ubuntu11:9.9.3.dfsg.P2-4ubuntu21:9.9.3.dfsg.P2-4ubuntu31:9.9.5.dfsg-21:9.9.5.dfsg-3
Show 29 moreShow less
1:9.9.5.dfsg-3ubuntu0.11:9.9.5.dfsg-3ubuntu0.21:9.9.5.dfsg-3ubuntu0.31:9.9.5.dfsg-3ubuntu0.41:9.9.5.dfsg-3ubuntu0.51:9.9.5.dfsg-3ubuntu0.61:9.9.5.dfsg-3ubuntu0.71:9.9.5.dfsg-3ubuntu0.81:9.9.5.dfsg-3ubuntu0.91:9.9.5.dfsg-3ubuntu0.101:9.9.5.dfsg-3ubuntu0.111:9.9.5.dfsg-3ubuntu0.121:9.9.5.dfsg-3ubuntu0.131:9.9.5.dfsg-3ubuntu0.141:9.9.5.dfsg-3ubuntu0.151:9.9.5.dfsg-3ubuntu0.161:9.9.5.dfsg-3ubuntu0.171:9.9.5.dfsg-3ubuntu0.181:9.9.5.dfsg-3ubuntu0.191:9.9.5.dfsg-3ubuntu0.19+esm11:9.9.5.dfsg-3ubuntu0.19+esm21:9.9.5.dfsg-3ubuntu0.19+esm31:9.9.5.dfsg-3ubuntu0.19+esm41:9.9.5.dfsg-3ubuntu0.19+esm51:9.9.5.dfsg-3ubuntu0.19+esm61:9.9.5.dfsg-3ubuntu0.19+esm71:9.9.5.dfsg-3ubuntu0.19+esm91:9.9.5.dfsg-3ubuntu0.19+esm101:9.9.5.dfsg-3ubuntu0.19+esm11
1:9.9.5.dfsg-3ubuntu0.19+esm12
unbound
Ubuntu:Pro:14.04:LTS
 before 1.4.22-1ubuntu4.14.04.3+esm5, plus listed versions
1.4.20-11.4.21-11.4.21-1ubuntu11.4.21-1ubuntu21.4.22-1ubuntu1
Show 10 moreShow less
1.4.22-1ubuntu21.4.22-1ubuntu31.4.22-1ubuntu41.4.22-1ubuntu4.14.04.11.4.22-1ubuntu4.14.04.21.4.22-1ubuntu4.14.04.31.4.22-1ubuntu4.14.04.3+esm11.4.22-1ubuntu4.14.04.3+esm21.4.22-1ubuntu4.14.04.3+esm31.4.22-1ubuntu4.14.04.3+esm4
1.4.22-1ubuntu4.14.04.3+esm5
bind9
Ubuntu:Pro:16.04:LTS
 before 1:9.10.3.dfsg.P4-8ubuntu1.19+esm8, plus listed versions
1:9.9.5.dfsg-11ubuntu11:9.9.5.dfsg-121:9.9.5.dfsg-12.11:9.9.5.dfsg-12.1ubuntu11:9.10.3.dfsg.P2-4
Show 30 moreShow less
1:9.10.3.dfsg.P2-51:9.10.3.dfsg.P4-31:9.10.3.dfsg.P4-41:9.10.3.dfsg.P4-51:9.10.3.dfsg.P4-81:9.10.3.dfsg.P4-8ubuntu11:9.10.3.dfsg.P4-8ubuntu1.11:9.10.3.dfsg.P4-8ubuntu1.21:9.10.3.dfsg.P4-8ubuntu1.31:9.10.3.dfsg.P4-8ubuntu1.41:9.10.3.dfsg.P4-8ubuntu1.51:9.10.3.dfsg.P4-8ubuntu1.61:9.10.3.dfsg.P4-8ubuntu1.71:9.10.3.dfsg.P4-8ubuntu1.81:9.10.3.dfsg.P4-8ubuntu1.91:9.10.3.dfsg.P4-8ubuntu1.101:9.10.3.dfsg.P4-8ubuntu1.111:9.10.3.dfsg.P4-8ubuntu1.121:9.10.3.dfsg.P4-8ubuntu1.141:9.10.3.dfsg.P4-8ubuntu1.151:9.10.3.dfsg.P4-8ubuntu1.161:9.10.3.dfsg.P4-8ubuntu1.171:9.10.3.dfsg.P4-8ubuntu1.181:9.10.3.dfsg.P4-8ubuntu1.191:9.10.3.dfsg.P4-8ubuntu1.19+esm11:9.10.3.dfsg.P4-8ubuntu1.19+esm21:9.10.3.dfsg.P4-8ubuntu1.19+esm31:9.10.3.dfsg.P4-8ubuntu1.19+esm51:9.10.3.dfsg.P4-8ubuntu1.19+esm61:9.10.3.dfsg.P4-8ubuntu1.19+esm7
1:9.10.3.dfsg.P4-8ubuntu1.19+esm8
dnsmasq
Ubuntu:Pro:16.04:LTS
 before 2.90-0ubuntu0.16.04.1+esm1, plus listed versions
2.75-12.75-1ubuntu0.16.04.12.75-1ubuntu0.16.04.22.75-1ubuntu0.16.04.32.75-1ubuntu0.16.04.4
Show 7 moreShow less
2.75-1ubuntu0.16.04.52.75-1ubuntu0.16.04.72.75-1ubuntu0.16.04.82.75-1ubuntu0.16.04.102.75-1ubuntu0.16.04.10+esm12.79-1ubuntu0.16.04.1+esm12.79-1ubuntu0.16.04.1+esm2
2.90-0ubuntu0.16.04.1+esm1
unbound
Ubuntu:Pro:16.04:LTS
 before 1.5.8-1ubuntu1.1+esm5, plus listed versions
1.4.22-1ubuntu61.5.7-1ubuntu11.5.7-1ubuntu21.5.8-1ubuntu11.5.8-1ubuntu1.1
Show 4 moreShow less
1.5.8-1ubuntu1.1+esm11.5.8-1ubuntu1.1+esm21.5.8-1ubuntu1.1+esm31.5.8-1ubuntu1.1+esm4
1.5.8-1ubuntu1.1+esm5
knot-resolver
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.0.0~beta2-123-g6134920-11.0.0~beta3-11.0.0~beta3-1ubuntu0.1~esm1
 None known
pdns-recursor
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.7.3-14.0.0~alpha1-14.0.0~alpha1-24.0.0~alpha2-24.0.0~alpha2-2ubuntu0.14.0.0~alpha2-2ubuntu0.1+esm1
 None known
bind9
Ubuntu:Pro:18.04:LTS
 before 1:9.11.3+dfsg-1ubuntu1.19+esm3, plus listed versions
1:9.10.3.dfsg.P4-12.6ubuntu11:9.11.2.P1-1ubuntu21:9.11.2.P1-1ubuntu31:9.11.2.P1-1ubuntu41:9.11.2.P1-1ubuntu5
Show 19 moreShow less
1:9.11.3+dfsg-1ubuntu11:9.11.3+dfsg-1ubuntu1.11:9.11.3+dfsg-1ubuntu1.21:9.11.3+dfsg-1ubuntu1.31:9.11.3+dfsg-1ubuntu1.51:9.11.3+dfsg-1ubuntu1.71:9.11.3+dfsg-1ubuntu1.81:9.11.3+dfsg-1ubuntu1.91:9.11.3+dfsg-1ubuntu1.101:9.11.3+dfsg-1ubuntu1.111:9.11.3+dfsg-1ubuntu1.121:9.11.3+dfsg-1ubuntu1.131:9.11.3+dfsg-1ubuntu1.141:9.11.3+dfsg-1ubuntu1.151:9.11.3+dfsg-1ubuntu1.161:9.11.3+dfsg-1ubuntu1.171:9.11.3+dfsg-1ubuntu1.181:9.11.3+dfsg-1ubuntu1.19+esm11:9.11.3+dfsg-1ubuntu1.19+esm2
1:9.11.3+dfsg-1ubuntu1.19+esm3
dnsmasq
Ubuntu:Pro:18.04:LTS
 before 2.90-0ubuntu0.18.04.1+esm1, plus listed versions
2.78-12.78-32.79-12.79-1ubuntu0.22.79-1ubuntu0.3
Show 4 moreShow less
2.79-1ubuntu0.42.79-1ubuntu0.52.79-1ubuntu0.62.79-1ubuntu0.7
2.90-0ubuntu0.18.04.1+esm1
unbound
Ubuntu:Pro:18.04:LTS
 before 1.6.7-1ubuntu2.6+esm6, plus listed versions
1.6.5-11.6.7-11.6.7-1build11.6.7-1ubuntu11.6.7-1ubuntu2
Show 10 moreShow less
1.6.7-1ubuntu2.11.6.7-1ubuntu2.21.6.7-1ubuntu2.31.6.7-1ubuntu2.41.6.7-1ubuntu2.51.6.7-1ubuntu2.61.6.7-1ubuntu2.6+esm21.6.7-1ubuntu2.6+esm31.6.7-1ubuntu2.6+esm41.6.7-1ubuntu2.6+esm5
1.6.7-1ubuntu2.6+esm6
knot-resolver
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.3-11.5.0-41.5.1-11.5.2-12.0.0-3
Show 4 moreShow less
2.1.0-12.1.0-22.1.1-12.1.1-1ubuntu0.1~esm2
 None known
pdns-recursor
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.0.6-14.0.6-1build14.0.7-14.1.1-14.1.1-1build14.1.1-24.1.1-2ubuntu0.1~esm1
 None known
bind9
Ubuntu:20.04:LTS
 before 1:9.16.48-0ubuntu0.20.04.1, plus listed versions
1:9.11.5.P4+dfsg-5.1ubuntu21:9.11.5.P4+dfsg-5.1ubuntu31:9.11.5.P4+dfsg-5.1ubuntu41:9.11.5.P4+dfsg-5.1ubuntu51:9.11.14+dfsg-1ubuntu1
Show 20 moreShow less
1:9.11.14+dfsg-3ubuntu11:9.16.0-1ubuntu31:9.16.0-1ubuntu41:9.16.0-1ubuntu51:9.16.1-0ubuntu11:9.16.1-0ubuntu21:9.16.1-0ubuntu2.11:9.16.1-0ubuntu2.21:9.16.1-0ubuntu2.31:9.16.1-0ubuntu2.41:9.16.1-0ubuntu2.61:9.16.1-0ubuntu2.71:9.16.1-0ubuntu2.81:9.16.1-0ubuntu2.91:9.16.1-0ubuntu2.101:9.16.1-0ubuntu2.111:9.16.1-0ubuntu2.121:9.16.1-0ubuntu2.141:9.16.1-0ubuntu2.151:9.16.1-0ubuntu2.16
1:9.16.48-0ubuntu0.20.04.1
dnsmasq
Ubuntu:20.04:LTS
 before 2.90-0ubuntu0.20.04.1, plus listed versions
2.80-1ubuntu22.80-1ubuntu42.80-1.1ubuntu12.80-1.1ubuntu1.22.80-1.1ubuntu1.3
Show 4 moreShow less
2.80-1.1ubuntu1.42.80-1.1ubuntu1.52.80-1.1ubuntu1.62.80-1.1ubuntu1.7
2.90-0ubuntu0.20.04.1
unbound
Ubuntu:20.04:LTS
 before 1.9.4-2ubuntu1.5, plus listed versions
1.9.0-2ubuntu11.9.0-2ubuntu21.9.4-21.9.4-2ubuntu11.9.4-2ubuntu1.11.9.4-2ubuntu1.21.9.4-2ubuntu1.31.9.4-2ubuntu1.4
1.9.4-2ubuntu1.5
bind9-libs
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:9.11.16+dfsg-3~build11:9.11.16+dfsg-3~ubuntu1
 None known
knot-resolver
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.2.1-33.2.1-3ubuntu13.2.1-3ubuntu23.2.1-3ubuntu2.13.2.1-3ubuntu2.2
 None known
pdns-recursor
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.2.0-64.2.1-14.2.1-1build14.2.1-1build24.2.1-1ubuntu0.1~esm1
 None known
bind9
Ubuntu:22.04:LTS
 before 1:9.18.18-0ubuntu0.22.04.2, plus listed versions
1:9.16.15-1ubuntu11:9.16.15-1ubuntu21:9.16.15-1ubuntu31:9.18.0-2ubuntu11:9.18.0-2ubuntu2
Show 9 moreShow less
1:9.18.0-2ubuntu31:9.18.1-1ubuntu11:9.18.1-1ubuntu1.11:9.18.1-1ubuntu1.21:9.18.1-1ubuntu1.31:9.18.12-0ubuntu0.22.04.11:9.18.12-0ubuntu0.22.04.21:9.18.12-0ubuntu0.22.04.31:9.18.18-0ubuntu0.22.04.1
1:9.18.18-0ubuntu0.22.04.2
bind9-libs
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:9.11.19+dfsg-2.1ubuntu11:9.11.19+dfsg-2.1ubuntu21:9.11.19+dfsg-2.1ubuntu3
 None known
dnsmasq
Ubuntu:22.04:LTS
 before 2.90-0ubuntu0.22.04.1, plus listed versions
2.85-1ubuntu22.86-1.12.86-1.1ubuntu0.12.86-1.1ubuntu0.22.86-1.1ubuntu0.32.86-1.1ubuntu0.42.86-1.1ubuntu0.5
2.90-0ubuntu0.22.04.1
unbound
Ubuntu:22.04:LTS
 before 1.13.1-1ubuntu5.4, plus listed versions
1.13.1-1ubuntu11.13.1-1ubuntu31.13.1-1ubuntu51.13.1-1ubuntu5.11.13.1-1ubuntu5.21.13.1-1ubuntu5.3
1.13.1-1ubuntu5.4
knot-resolver
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.3.1-15.4.2-15.4.3-15.4.4-15.4.4-1ubuntu0.1~esm1
 None known
pdns-recursor
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
4.4.2-34.6.0-1ubuntu14.6.0-1ubuntu1+esm1
 None known
isc-dhcp
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.4.3-P1-2ubuntu54.4.3-P1-4ubuntu14.4.3-P1-4ubuntu2
 None known
unbound
Ubuntu:24.04:LTS
 before 1.19.1-1ubuntu1, plus listed versions
1.17.1-21.18.0-2ubuntu11.18.0-2ubuntu2
1.19.1-1ubuntu1
isc-dhcp
Ubuntu:25.10
 All versions, plus listed versions
4.4.3-P1-4ubuntu2
 None known
isc-dhcp
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.4.3-P1-4ubuntu2
 None known
unbound
Ubuntu:Pro:20.04:LTS
 before 1.9.4-2ubuntu1.11+esm3, plus listed versions
1.9.0-2ubuntu11.9.0-2ubuntu21.9.4-21.9.4-2ubuntu11.9.4-2ubuntu1.1
Show 10 moreShow less
1.9.4-2ubuntu1.21.9.4-2ubuntu1.31.9.4-2ubuntu1.41.9.4-2ubuntu1.51.9.4-2ubuntu1.61.9.4-2ubuntu1.81.9.4-2ubuntu1.91.9.4-2ubuntu1.111.9.4-2ubuntu1.11+esm11.9.4-2ubuntu1.11+esm2
1.9.4-2ubuntu1.11+esm3
unbound
Ubuntu:22.04:LTS
 before 1.13.1-1ubuntu5.17, plus listed versions
1.13.1-1ubuntu11.13.1-1ubuntu31.13.1-1ubuntu51.13.1-1ubuntu5.11.13.1-1ubuntu5.2
Show 12 moreShow less
1.13.1-1ubuntu5.31.13.1-1ubuntu5.41.13.1-1ubuntu5.51.13.1-1ubuntu5.71.13.1-1ubuntu5.81.13.1-1ubuntu5.101.13.1-1ubuntu5.111.13.1-1ubuntu5.121.13.1-1ubuntu5.131.13.1-1ubuntu5.141.13.1-1ubuntu5.151.13.1-1ubuntu5.16
1.13.1-1ubuntu5.17
unbound
Ubuntu:24.04:LTS
 before 1.19.2-1ubuntu3.12, plus listed versions
1.17.1-21.18.0-2ubuntu11.18.0-2ubuntu21.19.1-1ubuntu11.19.2-1ubuntu1
Show 11 moreShow less
1.19.2-1ubuntu31.19.2-1ubuntu3.11.19.2-1ubuntu3.21.19.2-1ubuntu3.31.19.2-1ubuntu3.41.19.2-1ubuntu3.51.19.2-1ubuntu3.61.19.2-1ubuntu3.71.19.2-1ubuntu3.81.19.2-1ubuntu3.91.19.2-1ubuntu3.10
1.19.2-1ubuntu3.12
unbound
Ubuntu:26.04:LTS
 before 1.24.2-1ubuntu2.4, plus listed versions
1.22.0-2ubuntu21.22.0-2ubuntu41.24.2-1ubuntu11.24.2-1ubuntu21.24.2-1ubuntu2.11.24.2-1ubuntu2.21.24.2-1ubuntu2.3
1.24.2-1ubuntu2.4
pdns-recursor
openSUSE:Leap 15.5
 before 4.8.6-bp155.2.3.1
4.8.6-bp155.2.3.1
pdns-recursor
openSUSE:Tumbleweed
 before 5.0.2-1.1
5.0.2-1.1
bind
openSUSE:Tumbleweed
 before 9.18.24-1.1
9.18.24-1.1
dnsmasq
openSUSE:Tumbleweed
 before 2.90-1.1
2.90-1.1
unbound
openSUSE:Tumbleweed
 before 1.19.1-1.1
1.19.1-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubknqyf263/CVE-2023-503872024-02-18
PoC in GitHubMeirelez/SSR-DNSSEC2024-05-23
PoC in GitHubPablodiz/CVE-2023-503872024-12-04

History

History
RecordedChangedSources
affectedOSV
exploits
affected, aliases, aliases_more, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-50387 is a high vulnerability (CVSS 7.5) in Fedoraproject Fedora, published February 13, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in bind 9.16.48-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 929 package rows and 91 references. The JSON record has them. Also not on the record: 15 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 64 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open