CGA-rcc6-gvrm-wg3g

Summary

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

Description

Impact

Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.

Patches

Users should upgrade to dnsjava v3.6.0

Workarounds

Although not recommended, only using a non-validating resolver, will remove the vulnerability.

References

https://www.athene-center.de/en/keytrap