KeyTrap attack: Internet access disrupted with one DNS packet

KeyTrap (CVE-2023-50387) is a decades-old DNSSEC design flaw that enables algorithmic complexity attacks: a single crafted DNS packet can force resolvers to process excessive cryptographic keys and signatures (up to a ~2 million× increase in CPU instructions), stalling DNS resolution for between roughly one minute and many hours. Discovered and disclosed by ATHENE researchers, the issue affects many popular DNS implementations and services; major providers have applied mitigations, but researchers warn addressing the root cause may require rethinking DNSSEC validation design.