Input validation error in dnsjava - #VU162704
Published: November 9, 2026
Vulnerability identifier: #VU162704
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to make a digit-only Unicode address produce different, non-digit bytes in DNS wire format.
The vulnerability exists due to dnsjava's X25Record accepting Unicode decimal digits and narrowing each character to a byte during address serialization. An attacker can supply such an address to applications that trust successful record construction as validation, authorize the original string, and later process or transmit the serialized value.
Affected software
dnsjava
Remediation
Install security update from vendor's website.
dnsjava - update to 3.7.0