CVE-2024-25638 DNSJava DNSSEC Bypass
Attackers can bypass DNSSEC validation by injecting irrelevant records, compromising DNS integrity in applications using dnsjava.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-25638?
CVE-2024-25638 is a high-severity vulnerability in dnsjava, published on 22 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
Which versions are affected by CVE-2024-25638?
2 open source packages ship an affected version, including dnsjava:dnsjava.
| Package | Affected | Fixed in |
|---|---|---|
dnsjava:dnsjava Maven | All versions | 3.6.0 |
dnsjava:dnsjava Maven | All versions | 3.6.0 |
How do I fix CVE-2024-25638?
Upgrade dnsjava:dnsjava to 3.6.0 or later.
Is CVE-2024-25638 being exploited?
There is no known exploitation of CVE-2024-25638 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GU42194, CLEANSTART-2026-QE26022, CLSA-2026-1767917313, CLSA-2026-1788349374, DEBIAN-CVE-2024-25638, ECHO-c2b4-cbce-5703 and 7 more.