NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity AttacksGHSA-crjg-w57m-rqqf

MEDIUMFix: dnsjava/dnsjava@07ac36a

GHSA-crjg-w57m-rqqf is a medium-severity (CVSS 6.5) vulnerability in dnsjava:dnsjava. A fix is available for dnsjava:dnsjava — see the affected versions and patch details below.

Published
Updated
Affected
2 pkgs
Patched
1 / 2
Exploits
None indexed
Exploitation data as of Sep 10, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
☕dnsjava:dnsjava☕org.jitsi:dnssecjava

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap

Affected Packages

2 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavendnsjava:dnsjava≥ 3.5.0&&< 3.6.03.6.0dnsjava:dnsjava:3.6.0
☕Mavenorg.jitsi:dnssecjavaall versionsNo fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dnsjava:dnsjava, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update dnsjava:dnsjava to 3.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-crjg-w57m-rqqf is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Users using the `ValidatingResolver` for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones. ### Patches Users should upgrade to dnsjava v3.6.0 ### Workarounds Although not recommended, only using a non-validating resolver, will remove the vulnerability. ### References https://www.athene-center.de/en/keytrap
O3 Security · Impact-Aware SCA

Is GHSA-crjg-w57m-rqqf in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
DNSJava vulnerable to KeyTrap - Denial-of-Service…