Allocation of Resources Without Limits or Throttling in dnsjava - #VU162706
Published: November 9, 2026
Vulnerability identifier: #VU162706
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to degrade the availability of applications using dnsjava to parse untrusted DNS messages through amplified memory allocation.
The vulnerability exists due to DNS message parsing preallocating storage from header count fields without validating those counts against the remaining message bytes. An unauthenticated remote attacker can repeatedly submit 12-byte DNS messages with maximum count values to trigger approximately 2 MB of allocation per message and sustained memory pressure.
Affected software
dnsjava
Remediation
Install security update from vendor's website.
dnsjava - update to 3.7.0