CVE-2024-25638

HighCVSS 8.9/10Last modified Jun 17, 2026

Description

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

Metrics

CVSS 3.1 8.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-345 CWE-349

Affected software

Vendor	Product	Versions
dnsjava	dnsjava	< 3.6.0
dnsjava	dnsjava	< 3.6.0

References

Timeline

Published: Jul 22, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-256397.5Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's resp CVE-2024-25647.3A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the fi CVE-2024-256405.4Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scrip CVE-2024-256417.2Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exp CVE-2024-256427.4Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact wit CVE-2024-256434.3The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which m CVE-2024-256445.3Under certain conditions SAP NetWeaver WSRM - version 7.50, allows an attacker to access information which would otherwise be restricted, ca CVE-2024-256455.3Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be r CVE-2024-256466.5Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system CVE-2024-256476.7Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticat CVE-2024-256488.8A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code CVE-2024-256496.7In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the follo