SB2026110965 - Multiple vulnerabilities in dnsjava

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110965

SB2026110965 - Multiple vulnerabilities in dnsjava

Published: November 9, 2026

Security Bulletin ID SB2026110965
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Information Exposure Through Timing Discrepancy (CVE-ID: N/A)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker who knows a TSIG key name to obtain timing information about matching portions of a message authentication code.

The vulnerability exists due to a non-constant-time MAC comparison in dnsjava's TSIG verification that stops at the first difference. An unauthenticated remote attacker can resend a fixed message with varying MAC bytes to observe timing differences, although current JDK behavior makes remote exploitation appear impractical.


2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker to make a digit-only Unicode address produce different, non-digit bytes in DNS wire format.

The vulnerability exists due to dnsjava's X25Record accepting Unicode decimal digits and narrowing each character to a byte during address serialization. An attacker can supply such an address to applications that trust successful record construction as validation, authorize the original string, and later process or transmit the serialized value.


3) Improper Validation of Specified Index, Position, or Offset in Input (CVE-ID: N/A)

CWE-ID: CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash the calling thread or task of a DNS lookup in applications using dnsjava.

The vulnerability exists due to incorrect indexing during default response normalization when unrelated answer record sets precede a multi-record CNAME set, causing an uncaught exception. An unauthenticated remote attacker can control an authoritative DNS server and return a crafted response to a lookup for their domain to trigger this failure.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to degrade the availability of applications using dnsjava to parse untrusted DNS messages through amplified memory allocation.

The vulnerability exists due to DNS message parsing preallocating storage from header count fields without validating those counts against the remaining message bytes. An unauthenticated remote attacker can repeatedly submit 12-byte DNS messages with maximum count values to trigger approximately 2 MB of allocation per message and sustained memory pressure.


5) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker controlling a DoH endpoint to poison cached DNS answers for unrelated domains.

The vulnerability exists due to missing response-question validation in dnsjava's non-default DohResolver when used with LookupSession and a configured Cache. An attacker controlling a DoH endpoint can return a response naming another domain, causing its attacker-selected A record to be cached and returned for subsequent lookups without contacting the resolver.


Remediation

Install update from vendor's website.

References