cve.bz

CVE-2024-25638

8.9 highEPSS 0.4%

High (8.9). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in dnsjava:dnsjava 3.6.0.

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

Severity

CVSS 3.1

8.9 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
EPSS
0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWEs
CWE-345, CWE-349
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-cfxw-4h78-h7fwMavendnsjava:dnsjava<3.6.03.6.0

References

Check your stackJSON