DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks
Impact
Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.
Patches
Users should upgrade to dnsjava v3.6.0
Workarounds
Although not recommended, only using a non-validating resolver, will remove the vulnerability.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | dnsjava:dnsjava | >= 3.5.0, < 3.6.0 | 3.6.0 |
| Java / Kotlin (Maven) | org.jitsi:dnssecjava | <= 2.0.0 | no fix |
References
- https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf
- https://nvd.nist.gov/vuln/detail/CVE-2023-50387
- https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78
- https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf
- https://github.com/advisories/GHSA-8459-gg55-8qjj
- https://github.com/dnsjava/dnsjava
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-770- Platform
- Java / Kotlin (Maven)
- Package
dnsjava:dnsjava, org.jitsi:dnssecjava- Disclosed
- 22.07.2024
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-crjg-w57m-rqqf - CC BY 4.0
Vulnerability history: org.jitsi:dnssecjava
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 07.2024 07.2024
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2024: 2
- 2025: 0
- 2026: 0
-
DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.