# DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

Source: https://junglewise.ai/threats/dnsjava-affected-by-keytrap-nsec3-closest-encloser-proof-can-exhaust-37d29bde  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-07-22  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2024-07-22

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

Technologies: [dnsjava:dnsjava (Maven)](https://junglewise.ai/threats/technologies/dnsjava-dnsjava). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 22 July 2024.

**Which products and versions are affected?** dnsjava:dnsjava (Maven) ECOSYSTEM:introduced=3.5.0,fixed=3.6.0; org.jitsi:dnssecjava (Maven) ECOSYSTEM:introduced=0,last_affected=2.0.0.

**Is there a fix for This vulnerability?** Yes. dnsjava:dnsjava (Maven): upgrade to 3.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run dnsjava:dnsjava (Maven) or org.jitsi:dnssecjava (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dnsjava:dnsjava (Maven): upgrade to 3.6.0 or later

  ```sh
  # set dnsjava:dnsjava to 3.6.0 in your pom.xml or build.gradle
  ```


## Affected products

- dnsjava:dnsjava (Maven) ECOSYSTEM:introduced=3.5.0,fixed=3.6.0
- org.jitsi:dnssecjava (Maven) ECOSYSTEM:introduced=0,last_affected=2.0.0

## Related threats

- [DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks](https://junglewise.ai/threats/dnsjava-vulnerable-to-keytrap-denial-of-service-algorithmic-complexity-16e5bdfc)
- [DNSJava DNSSEC Bypass](https://junglewise.ai/threats/cve-2024-25638-dnsjava-dnssec-bypass)