High severity8.9OSV Advisory· Published Jul 22, 2024· Updated Apr 15, 2026
CVE-2024-25638
CVE-2024-25638
Description
dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dnsjava:dnsjavaMaven | < 3.6.0 | 3.6.0 |
Affected products
15- osv-coords14 versionspkg:apk/chainguard/apache-nifipkg:apk/chainguard/apache-nifi-compatpkg:apk/chainguard/apache-nifi-toolkitpkg:apk/chainguard/celeborn-0.5pkg:apk/chainguard/celeborn-0.6pkg:apk/chainguard/hadoop-client-modulespkg:apk/chainguard/tezpkg:apk/wolfi/apache-nifipkg:apk/wolfi/apache-nifi-compatpkg:apk/wolfi/apache-nifi-toolkitpkg:apk/wolfi/celeborn-0.5pkg:apk/wolfi/celeborn-0.6pkg:apk/wolfi/tezpkg:maven/dnsjava/dnsjava
< 2.0.0-r0+ 13 more
- (no CPE)range: < 2.0.0-r0
- (no CPE)range: < 2.0.0-r0
- (no CPE)range: < 2.0.0-r0
- (no CPE)range: < 0.5.4-r26
- (no CPE)range: < 0.6.3-r7
- (no CPE)range: < 3.3.6-r8
- (no CPE)range: < 0.10.4-r6
- (no CPE)range: < 2.0.0-r0
- (no CPE)range: < 2.0.0-r0
- (no CPE)range: < 2.0.0-r0
- (no CPE)range: < 0.5.4-r26
- (no CPE)range: < 0.6.3-r7
- (no CPE)range: < 0.10.4-r6
- (no CPE)range: < 3.6.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-cfxw-4h78-h7fwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-25638ghsaADVISORY
- github.com/dnsjava/dnsjava/commit/2073a0cdea2c560465f7ac0cc56f202e6fc39705nvdWEB
- github.com/dnsjava/dnsjava/security/advisories/GHSA-cfxw-4h78-h7fwnvdWEB
- github.com/dnsjava/dnsjava/commit/bc51df1c455e6c9fb7cbd42fcb6d62d16047818dnvd
News mentions
0No linked articles in our index yet.