Skip to content
Fencer Vulns
high 8.9

CVE-2024-25638 json

DNSJava DNSSEC Bypass

published 2024-07-22 2 y ago modified 2026-09-10 1 mo ago also GHSA-cfxw-4h78-h7fw , EUVD-2024-2321

cvss
8.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

Patch / fix

  • maven dnsjava:dnsjava 3.6.0
  • dnsjava dnsjava 3.6.0
  • dnsjava Debian 14, Debian 13 3.6.2-1

debian advisories DEBIAN-CVE-2024-25638

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-25638 updated cvss 8.9

dnsjava: Improper response validation allowing DNSSEC bypass

  • Red Hat Fuse 7 dnsjava Red Hat Integration Camel K 1 dnsjava Red Hat JBoss Data Grid 7 dnsjava, org.xbill/dnsjava org.xbill/dnsjava
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat build of Apache Camel for Spring Boot 3 dnsjava Red Hat build of Apache Camel for Spring Boot 4 dnsjava Red Hat JBoss Enterprise Application Platform 7 dnsjava Red Hat JBoss Enterprise Application Platform 8 dnsjava Red Hat JBoss Enterprise Application Platform Expansion Pack dnsjava
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
GitHub 3.1 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
maven dnsjava:dnsjava
<3.6.0
3.6.0

Affected products

  • dnsjava dnsjava

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.