Release notes from dnsjava

v3.6.5

2026-05-23T11:46:48Z

Handle canceled keys in UDP client (#129)
Handle interrupts on NIO selector thread (#396, #397)
Fix config option key names in README (@lostnet, #399)
Handle invalid/uninitialized file times in hosts file (#400)
Add getXxxAsByteArray() getters and overload with escape boolean (@MMauro94, #404, #405)

Note: The tag for this release is v3.6.5-1, because the v3.6.5 tag accidentally pointed to a local branch and cannot be changed anymore because of the immutable releases. The Maven artifacts from the Actions run are correct.

Full Changelog: v3.6.4...v3.6.5-1

v3.6.4

2026-01-18T17:02:40Z

Fix Zone-class serialization (#391)
Avoid Double DNS Lookup for Names with Labels >= ndots (#388)
Prevent NPE when calling Message#getTSIG() on DNS request with bad header (#384)
Unwrap an exception in the legacy callback-based async interface (#383)
Prevent ConcurrentModificationException in NIO clients (#379, @bhaveshthakker)
Handle null in all setSearchPath overloads equally (#157)
Reduce warning level of invalid hosts file entries (#371)
Remove a lock on the hot-path in the hosts file parser (#371)
DoH Resolver makes use of the Multi-Release jar and tests are executed for Java 8 and 11+ implementations (#385)
Fix DoH Resolver initial request delay (#385)

Full Changelog: v3.6.3...v3.6.4

v3.6.3

2026-05-23T11:35:17Z

Support custom hosts file size (@flaming-archer, #349)
Fix origin handling in zone loaded from file or stream (#346)
Prevent TCP port leak when closing IO (#351)
Fix confusing parameter name in CNAMERecord (@chkal, #354)
Optionally disable ShutdownHook in NioClient (@SvenssonWeb, #359)
TSIG algorithm names from RFC 8945
Message.toWire can exceed MAXLENGTH (#355)
TCP query might fail if the shared buffer is full (#357)
Dynamic updates silently truncates records (#356)
Fix DoH initial request using recommended nanoTime calculation (@LinZong, #345)

v3.6.2

2024-09-21T07:58:35Z

Add new IANA Trust Anchor (@technoLord, #337)
Fix Zone handling with signed SOA (@frankarinnet, #335)

v3.6.1

2024-07-28T16:11:48Z

Properly fix LookupSession doesn't cache CNAMEs (#316)
Move JEP-418 SPI to Java 18 to support EOL workflows (#329)

v3.6.0

2024-07-21T13:18:14Z

Fix CVE-2024-25638 (GHSA-cfxw-4h78-h7fw)
Lookup and LookupSession do not sanitize input properly, allowing to smuggle additional responses, even with DNSSEC. I would like to thank Thomas Bellebaum from Fraunhofer AISEC (@bellebaum) and Martin Schanzenbach (@schanzen) for reporting and assisting me with this issue.
Fix CVE-2023-50387 (GHSA-crjg-w57m-rqqf)
Denial-of-Service Algorithmic Complexity Attacks (KeyTrap)
Fix CVE-2023-50868 (GHSA-mmwx-rj87-vfgr)
NSEC3 closest encloser proof can exhaust CPU resources (KeyTrap)
Fix running all DNSSEC on the specified executor
Add new DNSSEC algorithm constants for SM2SM3 and ECC-GOST12
Add A/AAAA record constructor with IP address byte array
Validate DS record digest lengths (#250)
Fix NPE in SimpleResolver on invalid responses (#277)
Add support for JEP 418: Internet-Address Resolution SPI (#290)
Full JPMS support (#246)
Pluggable I/O for SimpleResolver
(@chrisruffalo, #253)
UDP port leak in SimpleResolver (#318)
Fix clean shutdown in app containers when never used (#319)
Fix concurrency issue in I/O clients (#315, #323)
LookupSession doesn't cache CNAMEs (#316)
SimpleResolver can fail with UPDATE response (#322)
Replace synchronization in Zone with locks
(#305, based on work from @srijeet0406 in #306)

v3.5.3

2023-11-11T10:56:58Z

Fix CNAME in LookupSession (#279)
Fix Name constructor failing with max length, relative name and root origin (#289, @MMauro94)
Add config option for Resolver I/O timeout (#273, @vmarian2)
Extend I/O logging
Prevent exception during TCP I/O with missing or truncated length prefix
Use internal base64 codec for Android compatibility (#271)
Fix multi-message TSIG stream verification for pre-RFC8945 servers (#295, @frankarinnet and @nguichon)
Add StreamGenerator for generating RFC8945 compliant multi-message streams (related to #295)

v3.5.2

2022-11-16T10:17:46Z

Correctly render empty TXT records (#254)
More validation on TLSA data input (#257)

v3.5.1

2022-05-15T15:10:20Z

Fix validation of TSIG signed responses (#249)
DS rdata digest validation hexadecimal digits (#252)

v3.5.0

2022-02-05T19:27:57Z

Add full built-in support for DNSSEC based on dnssecjava (#209)
Make Record classes serializable again (#242)
Allow SVCB ServiceMode records without params (#244, @adam-stoler)
Fix TCPClient receive timeouts (#218 @nguydavi, #219)

Note that the license changed! Previous versions were BSD-2-Clause licensed, while from this release on it is BSD-3-Clause.