KeyTrap and NSEC3 vulnerabilities affecting most DNSSEC implementations
Two vulnerabilities have been identified in various implementations of the DNSSEC protocol affecting DNS resolvers BIND, PowerDNS, dnsmasq, Knot Resolver, and Unbound. These vulnerabilities allow denial of service attacks against DNS resolvers performing validation using DNSSEC due to increased CPU load, which hampers the processing of other requests. To carry out the attack, it is sufficient to send a request to a DNS resolver using DNSSEC that leads to a specially crafted […]
