GHSA-crjg-w57m-rqqf

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

7.7 HighFix available

GHSA-crjg-w57m-rqqf is a high vulnerability (CVSS 7.7) in dnsjava:dnsjava, published July 22, 2024. No source lists public exploit code. Fixed in dnsjava:dnsjava 3.6.0.

What does this mean?

Severity: 7.7 HighCVSS 4.0, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 3.6.0dnsjava:dnsjava +3 more

Description

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Affected packages

Affected packages
Package	Affected	Fixed
`dnsjava:dnsjava` Maven	3.5.0 up to 3.6.0	3.6.0
`org.jitsi:dnssecjava` Maven	through 2.0.0	None known
`dnsjava:dnsjava` Maven	3.5.0 up to 3.6.0, plus listed versions 3.5.13.5.23.5.3	3.6.0
`org.jitsi:dnssecjava` Maven	through 2.0.0, plus listed versions 1.01.11.1.11.1.21.1.31.2.0	None known

What each source reports

GitHub Advisories Score used7.7

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Record: GHSA-crjg-w57m-rqqf
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSV7.7

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Record: GHSA-crjg-w57m-rqqf
CVSS 4.0: 7.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.