CVE-2026-81928
UnknownSummary
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. The recursion is reached only when the decoded TSIG carries an empty MAC and only from code that re-encodes a decoded message, such as a forwarder or a proxy. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
Risk Assessment
A remote attacker can cause a process crash (denial of service) by sending a specially crafted DNS message, potentially leading to disruption of network services.
Recommendation
Update the Net::DNS library to version 1.57 or later to mitigate this vulnerability.
Other vulnerabilities in Net::DNS
See all- CVE-2026-64193Critical
A vulnerability in the Net::DNS library for Perl (versions up to 1.55) allows remote code execution via a crafted EDNS EXTENDED ERROR record. The _decompose function improperly handles backtick characters (`), enabling system command injection.
- CVE-2026-64194High
Vulnerability in Net::DNS for Perl up to version 1.55. Allows DoS via deep DNS compression pointer chains. The decode function recursively processes pointers without depth limit, potentially overflowing the stack and causing SIGSEGV.
Original NVD description (English source)
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.