CVE-2024-25638CWE-345CWE-349

DNSJava DNSSEC Bypass

High · published July 22, 2024

CVSS v3.1
8.9
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.1th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-349 · Acceptance of Extraneous Untrusted Data With Trusted Data
Published
2024-07-22T14:05Z
EPSS history
Timeline
  • 22 JUL 14:05Z
    DNSJava DNSSEC Bypass
    cvelistv5