Vulnerability in Dnsjava
CVE-2024-25638
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
EPSS: 0.002 (41.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.9 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L.
Affected products
- Dnsjava — versions < 3.6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- https://github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fw (x_refsource_CONFIRM)
- https://github.com/dnsjava/dnsjava/commit/2073a0cdea2c560465f7ac0cc56f202e6fc39705 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-25638?
- CVE-2024-25638 is a high-severity vulnerability in Dnsjava, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.9/10. Published 2024-07-22.
- How severe is CVE-2024-25638?
- High severity. CVSS v3 base score is 8.9 out of 10.
- Is CVE-2024-25638 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.