CVE-2024-25638 HIGH

CVE-2024-25638: DNSJava DNSSEC Bypass

Vendor Dnsjava

Product dnsjava

Weakness CWE-345

Published July 22, 2024

Last update July 24, 2025

View on NVD All CVEs

CVSS base score

8.9/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

Key dates

02Disclosure timeline

July 22, 2024 CVE published

July 24, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-25638 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/345.html AskarLabs — CWE-345 write-up Insufficient Verification of Data Authenticity

Related vulnerabilities

04Related CVE

CVE-2026-2428 Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification CVE-2026-9242 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request CVE-2025-12752 Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation CVE-2023-2987 Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature CVE-2021-24825 Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI