Just one bad packet can bring down a vulnerable DNS server thanks to DNSSEC

**Executive summary:** KeyTrap (CVE-2023-50387) is a long-standing DNSSEC validation design flaw that enables a single malicious DNS response to force DNSSEC-validating resolvers into extreme CPU exhaustion, potentially disabling resolution at Internet scale; researchers disclosed the issue privately, vendors released patches for major implementations (Unbound, BIND, PowerDNS, and public providers), and no active exploitation has been reported.