GHSA-mmwx-rj87-vfgr

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

7.1 HighFix available

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

What each source reports

GitHub Advisories Score used7.1

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Record: GHSA-mmwx-rj87-vfgr
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV7.1

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Record: GHSA-mmwx-rj87-vfgr
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`dnsjava:dnsjava` Maven	3.5.0 up to 3.6.0	3.6.0
`org.jitsi:dnssecjava` Maven	through 2.0.0	None known
`dnsjava:dnsjava` Maven	3.5.0 up to 3.6.0, plus listed versions 3.5.13.5.23.5.3	3.6.0
`org.jitsi:dnssecjava` Maven	through 2.0.0, plus listed versions 1.01.11.1.11.1.21.1.31.2.0	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-mmwx-rj87-vfgr is a high vulnerability (CVSS 7.1) in dnsjava:dnsjava, published July 22, 2024. No source lists public exploit code. Fixed in dnsjava:dnsjava 3.6.0.